[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Gazer can establish persistence by creating a .lnk file in the Start menu.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Bisonal has the capability to download files to execute on the victim’s machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Chaes has collected system information, including the machine name and OS version.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module  and then deleting it from the hard disk as well as overwriting the data with null bytes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Several tools used by Suckfly have been command-line driven.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BRONZE BUTLER has used batch scripts and the command-line interface for execution.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Carbon can list the processes on the victim’s machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Rocke has used uname -m to collect the name and information about the infected system's kernel.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
InnaputRAT has a command to delete files.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
ABK has the ability to use HTTP in communications with C2.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
KOPILUWAK has used HTTP POST requests to send data to C2.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
InvisiMole uses HTTP for C2 communications.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
WIRTE has used Base64 to decode malicious VBS script.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FIN7 used the command prompt to launch commands on the victim’s machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
3PARA RAT uses HTTP for command and control.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Industroyer decrypts code to connect to a remote C2 server.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DDKONG downloads and uploads files on the victim’s machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
HTTPBrowser deletes its original installer file once installation is complete.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Diavol has used HTTP GET and POST requests for C2.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Astaroth spawns a CMD process to execute commands.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Bumblebee can use `cmd.exe` to drop and run files.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BackConfig has the ability to remove files and folders related to previous infections.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Carberp has connected to C2 servers via HTTP.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
APT38 have enumerated files and directories, or searched in specific locations within a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
GuLoader can delete its executable from the AppData\Local\Temp directory on the compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FunnyDream can delete files including its dropper component.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Get2 has the ability to identify running processes on an infected host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Clambling can enumerate the IP address of a compromised machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Water Curupira Pikabot Distribution used Curl.exe to download the Pikabot payload from an external server, saving the file to the victim machine's temporary directory.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Threat Group-3390 actors use NBTscan to discover vulnerable systems.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Dacls can scan directories on a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BLUELIGHT can enumerate files and collect associated metadata.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Aquatic Panda has deleted malicious executables from compromised machines.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BADFLICK can decode shellcode using a custom rotating XOR cipher.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BITTER has downloaded additional malware and tools onto a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
AcidRain identifies specific files and directories in the Linux operating system associated with storage devices.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Lizar has a plugin designed to obtain a list of processes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
TA551 has used cmd.exe to execute commands.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by Lazarus Group also collects disk space information and sends it to its C2 server.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
MacMa can enumerate running processes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Aria-body has the ability to delete files and directories on compromised hosts.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
InnaputRAT gathers volume drive information and system information.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BBK has the ability to download files from C2 to the infected host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
CrackMapExec can enumerate the system drives and associated system name.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Patchwork removed certain files and replaced them so they could not be retrieved.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
KGH_SPY can decrypt encrypted strings and write them to a newly created folder.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm -128 key and decoded using a XOR key.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During Frankenstein, the threat actors downloaded files and tools onto a victim machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
ToddyCat has run `cmd /c start /b tasklist` to enumerate processes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Apostle writes batch scripts to disk, such as system.bat and remover.bat, that perform various anti-analysis and anti-forensic tasks, before finally deleting themselves at the end of execution. Apostle attempts to delete itself after encryption or wiping operations are complete and before shutting down the victim machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FELIXROOT adds a shortcut file to the startup folder for persistence.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Emotet has used a self-extracting RAR file to deliver modules to victims. Emotet has also extracted embedded executables from files using hard-coded buffer offsets.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
APT37's Freenki malware lists running processes using the Microsoft Windows API.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
HAFNIUM has used `tasklist` to enumerate processes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
One persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
CORESHELL downloads another dropper from its C2 server.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
LunarMail can decrypt strings to retrieve configuration settings.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Flagpro has dropped an executable file to the startup directory.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DarkTortilla can enumerate a list of running processes on a compromised system.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Hydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Malteiro collects the machine information, system architecture, the OS version, computer name, and Windows product name.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Apostle compiled code is obfuscated in an unspecified fashion prior to delivery to victims.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Dipsind can spawn remote shells.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
APT18 can list files information for specific directories.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Turla surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, net config, ipconfig /all, and route commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Gelsemium can use HTTP/S in C2 communications.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FlawedAmmyy can collect the victim's operating system and computer name during the initial infection.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Epic uses the tasklist /v command to obtain a list of processes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Rancor has downloaded additional malware, including by using certutil.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
CSPY Downloader can download additional tools to a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DustySky collects information about running processes from victims.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
INC Ransomware can run `CryptStringToBinaryA` to decrypt base64 content containing its ransom note.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
GravityRAT collects the victim IP address, MAC address, as well as the victim account domain name.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Caterpillar WebShell has a module to gather information from the compromrised asset, including the computer version, computer name, IIS version, and more.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer  by using the COM interface IWebBrowser2.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DownPaper uses PowerShell to add a Registry Run key in order to establish persistence.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BADFLICK has searched for files on the infected host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During C0015, the threat actors downloaded additional tools and files onto a compromised network.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Moonstone Sleet delivered payloads using multiple rounds of obfuscation and encoding to evade defenses and analysis.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
HotCroissant has the ability to list running processes on the infected host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
GeminiDuke collects information on running processes and environment variables from the victim.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: dir c:\ >> %temp%\download dir "c:\Documents and Settings" >> %temp%\download dir "c:\Program Files\" >> %temp%\download dir d:\ >> %temp%\download
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Tonto Team has downloaded malicious DLLs which served as a ShadowPad loader.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During Operation Wocao, the threat actors consistently removed traces of their activity by first overwriting a file using `/c cd /d c:\windows\temp\ & copy \\<IP ADDRESS>\c$\windows\system32\devmgr.dll \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1 /y` and then deleting the overwritten file using `/c cd /d c:\windows\temp\ & del \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1`.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DarkGate uses the Delphi methods Sysutils::DiskSize and GlobalMemoryStatusEx to collect disk size and physical memory as part of the malware's anti-analysis checks for running in a virtualized environment. DarkGate will gather various system information such as display adapter description, operating system type and version, processor type, and RAM amount.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BoxCaon can collect the victim's MAC address by using the GetAdaptersInfo API.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FELIXROOT uses HTTP and HTTPS to communicate with the C2 server.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Chinoxy has established persistence via the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` registry key and by loading a dropper to ``.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Brute Ratel C4 can download files to compromised hosts.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
AuTo Stealer can use HTTP to communicate with its C2 servers.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Winter Vivern executed PowerShell scripts to create scheduled tasks to retrieve remotely-hosted payloads.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
A dropper used by Putter Panda installs itself into the ASEP Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a value named McUpdate.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During Operation Sharpshooter, a first-stage downloader installed Rising Sun to `%Startup%\mssync.exe` on a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Crimson can decode its encoded PE file prior to execution.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Elise is capable of launching a remote shell on the host to delete itself.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Some versions of DarkGate search for the hard-coded folder C:\Program Files\e Carte Bleue.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
AvosLocker has searched for files and directories on a compromised network.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DarkGate uses a malicious Windows Batch script to run the Windows code utility to retrieve follow-on script payloads.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Dark Caracal's version of Bandook adds a registry key to HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Winter Vivern distributed Windows batch scripts disguised as virus scanners to prompt download of malicious payloads using built-in system tools.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BLUELIGHT can uninstall itself.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DarkTortilla can decrypt its payload and associated configuration elements using the Rijndael cipher.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Orangeworm has used HTTP for C2.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DarkWatchman has the ability to enumerate file and folder names.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Cardinal RAT can download and execute additional payloads.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Daggerfly utilizes victim machine operating system information to create custom User Agent strings for subsequent command and control communication.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
The IceApple Server Variable Dumper module iterates over all server variables present for the current request and returns them to the adversary.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
ChChes collects the victim hostname, window resolution, and Microsoft Windows version.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
IPsec Helper connects to command and control servers via HTTP POST requests based on parameters hard-coded into the malware.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Daserf uses HTTP for C2.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Calisto has the capability to upload and download files to the victim's machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
APT28 has deployed malware that has copied itself to the startup directory for persistence.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FlawedAmmyy has used HTTP for C2.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During Operation Dream Job, Lazarus Group launched malicious DLL files, created new folders, and renamed folders with the use of the Windows command shell.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Tropic Trooper has created shortcuts in the Startup folder to establish persistence.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
AppleJeus has collected the victim host information after infection.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FIN8 has used HTTPS for command and control.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DEADEYE can run `cmd /c copy /y /b C:\Users\public\syslog_6-*.dat C:\Users\public\syslog.dll` to combine separated sections of code into a single DLL prior to execution.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
APT41 used cmd.exe /c to execute commands on remote machines. APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
KV Botnet Activity removes on-disk copies of tools and other artifacts after it the primary botnet payload has been loaded into memory on the victim device.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Brute Ratel C4 can enumerate all processes and locate specific process IDs .
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Bandook has decoded its PowerShell script.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
EvilBunny has executed C2 commands directly via HTTP.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BLACKCOFFEE has the capability to discover processes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BabyShark has used dir to search for "programfiles" and "appdata".
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During C0017, APT41 used `cmd.exe /c ping %userdomain%` for discovery.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
TeamTNT has enumerated the host machine’s IP address.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Volt Typhoon has used the Windows command line to perform hands-on-keyboard activities in targeted environments including for discovery.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
AvosLocker has discovered system processes by calling `RmGetList`.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Sidewinder has used malware to collect information on network interfaces, including the MAC address.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During Night Dragon, threat actors used HTTP for C2.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Epic uses the nbtstat -n and nbtstat -s commands on the victim’s machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Patchwork payloads download additional files from the C2 server.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
RedCurl has searched for and collected files on local and network drives.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BoomBox has the ability to download next stage malware components to a compromised system.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
TeamTNT has added batch scripts to the startup folder.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Volt Typhoon has downloaded an outdated version of comsvcs.dll to a compromised domain controller in a non-standard folder.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, machine GUID, and disk information on a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DarkTortilla has used HTTP and HTTPS for C2.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Aria-body has the ability to gather metadata from a file and to search for file and directory names.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Action RAT has the ability to collect drive and file information on an infected machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
APT18 uses HTTP for C2 communications.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Winter Vivern uses HTTP and HTTPS protocols for exfiltration and command and control activity.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Explosive has used HTTP for communication.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Turla has used shellcode to download Meterpreter after compromising a victim.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Cardinal RAT can execute commands.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Winter Vivern delivered exploit payloads via base64-encoded payloads in malicious email messages.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Bundlore has used openssl to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Rocke has deleted files on infected machines.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
AuditCred uses XOR and RC4 to perform decryption on the code functions.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Bundlore has used the ps command to list processes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Conti can discover files on a local system.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
CookieMiner has used Google Chrome's decryption and extraction operations.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
MuddyWater has used malware to collect the victim’s IP address and domain name.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
The reconnaissance modules used with Duqu can collect information on network configuration.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
An APT19 HTTP malware variant establishes persistence by setting the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BLUELIGHT can collect IP information from the victim’s machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Molerats saved malicious files within the AppData and Startup folders to maintain persistence.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
HAFNIUM has used `cmd.exe` to execute commands on the victim's machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Akira examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware. These checks are performed through native Windows functions such as GetFileAttributesW.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
SideCopy has identified the IP address of a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Cyclops Blink can use the Linux API `statvfs` to enumerate the current working directory.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Threat Group-3390's malware can add a Registry key to `Software\Microsoft\Windows\CurrentVersion\Run` for persistence.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FoggyWeb has the ability to communicate with C2 servers over HTTP GET/POST requests.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Gootloader can create an autorun entry for a PowerShell script to run at reboot.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Gazer has commands to delete files and persistence mechanisms from the victim.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FIN10 has executed malicious .bat files containing PowerShell commands.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Tropic Trooper has used a delivered trojan to download additional files.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FIN5 uses SDelete to clean up the environment and attempt to prevent detection.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
ToddyCat has run scripts to enumerate recently modified documents having either a .pdf, .doc, .docx, .xls or .xlsx extension.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Dridex has collected the computer name and OS architecture information from the system.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Magic Hound malware has used Registry Run keys to establish persistence.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BADFLICK has captured victim computer name, memory space, and CPU details.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader. Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
APT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Bisonal can obtain a list of running processes on the victim’s machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During Operation Dream Job, Lazarus Group downloaded multistage malware and tools onto a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Mustang Panda has created the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobelmdyU to maintain persistence.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Windshift has used tools to deploy additional payloads to compromised hosts.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
AdFind can extract subnet information from Active Directory.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
CARROTBALL has the ability to download and install a remote payload.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Kimsuky has decoded malicious VBScripts using Base64.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Ixeshe has a command to delete a file from the machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Amadey can identify the IP address of a victim machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Bandook has a command to delete a file.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BlackCat can obtain the computer name and UUID, and enumerate local drives.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Tropic Trooper has used scripts to collect the host's network topology.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DUSTTRAP can enumerate running processes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Windigo has used a script to check for the presence of files created by OpenSSH backdoors.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
AvosLocker has been executed via the `RunOnce` Registry key to run itself on safe mode.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DanBot has the ability to execute arbitrary commands via `cmd.exe`.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
GALLIUM used ipconfig /all to obtain information about the victim network configuration. The group also ran a modified version of NBTscan to identify available NetBIOS name servers.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
APT3 has a tool that can list out currently running processes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FIN8 has used remote code execution to download subsequent payloads.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Carbanak lists running processes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During Operation Honeybee, malicious files were decoded prior to execution.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
APT5 has used Windows-based utilities to carry out tasks including tasklist.exe.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Kessel has decrypted the binary's configuration once the main function was launched.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
AuditCred can delete files from the system.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Chrommme can decrypt its encrypted internal code.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BUBBLEWRAP can communicate using HTTP or HTTPS.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Moonstone Sleet has gathered information on victim systems.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
APT3 places scripts in the startup folder for persistence.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DUSTTRAP can execute commands via `cmd.exe`.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
GravityRAT collects the MAC address, computer name, and CPU information.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Gazer communicates with its C2 servers over HTTP.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Earth Lusca has used certutil to decode a string into a cabinet file.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Gamaredon Group tools can delete files used during an operation.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Chrommme has the ability to list drives and obtain the computer name of a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
FunnyDream can parse the `ProxyServer` string in the Registry to discover http proxies.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Catchamas gathers the Mac address, IP address, and the network adapter information from the victim’s machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Conti has decrypted its payload using a hardcoded AES-256 key.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
CreepyDrive can download files to the compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During FunnyDream, the threat actors used ipconfig for discovery on remote systems.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
HermeticWiper has the ability to overwrite its own file with random bites.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Bazar can decrypt downloaded payloads. Bazar also resolves strings and other artifacts at runtime.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Kazuar gathers information about network adapters.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Ke3chang uses command-line interaction to search files and directories.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
RedCurl has used the Windows Command Prompt to execute commands.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Ferocious can delete files from a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
CARROTBAT has the ability to execute command line arguments on a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
EvilBunny has created Registry keys for persistence in HKLM|HKCU\…\CurrentVersion\Run.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Malteiro has the ability to deobfuscate downloaded files prior to execution.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
OilRig has run tasklist on a victim's machine.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Attor’s plugin deletes the collected files and log files after exfiltration.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Backdoor.Oldrea collects information about the Internet adapter configuration.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Clambling can browse directories on a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During C0017, APT41 issued `ping -n 1 .split-1+` commands to find the volume serial number of compromised systems.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Carbon can collect the IP address of the victims and other computers on the network using the commands: ipconfig -all nbtstat -n, and nbtstat -s.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BADNEWS is capable of executing commands via cmd.exe.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
ChChes establishes persistence by adding a Registry Run key.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
EVILNUM can achieve persistence through the Registry Run key.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
CreepyDrive can specify the local file path to upload files from.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Bankshot uses HTTP for command and control communication.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Aria-body has used HTTP in C2 communications.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Crimson has the ability to delete files from a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Various implementations of CHOPSTICK communicate with C2 over HTTP.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During its initial execution, BACKSPACE extracts operating system information from the infected host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
One variant of CloudDuke uses HTTP and HTTPS for C2.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DownPaper uses the command line.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Backdoor.Oldrea collects information about running processes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Bad Rabbit can enumerate all running processes to compare hashes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Hi-Zor deletes its RAT installer file as it executes its DLL payload file.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Confucius has used a file stealer that can examine system drives, including those other than the C drive.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Avenger has the ability to download files from C2 to a compromised host.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BackConfig has used a custom routine to decrypt strings.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
CreepySnail can use `getmac` and `Get-NetIPAddress` to enumerate network settings.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
DUSTTRAP can enumerate files and directories.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Crimson contains a command to collect the victim MAC address and LAN IP.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Scattered Spider Spider enumerates a target organization for files and directories of interest, including source code.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
OilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Cinnamon Tempest has executed ransomware using batch scripts deployed via GPO.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
During Frankenstein, the threat actors used Empire to obtain a list of all running processes.
</cti>


[User]
What ATT&CK technique does the following CTI procedure sentence describe?

<cti>
BlackCat can enumerate files for encryption.
</cti>