{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGazer can establish persistence by creating a .lnk file in the Start menu.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBisonal has the capability to download files to execute on the victim\u2019s machine.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nJPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nmenuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nChaes has collected system information, including the machine name and OS version.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDerusbi is capable of deleting files. It has been observed loading a Linux Kernel Module  and then deleting it from the hard disk as well as overwriting the data with null bytes.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nSeveral tools used by Suckfly have been command-line driven.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAgent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBRONZE BUTLER has used batch scripts and the command-line interface for execution.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCarbon can list the processes on the victim\u2019s machine.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nRocke has used uname -m to collect the name and information about the infected system's kernel.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nInnaputRAT has a command to delete files.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nABK has the ability to use HTTP in communications with C2.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nKOPILUWAK has used HTTP POST requests to send data to C2.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nInvisiMole uses HTTP for C2 communications.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nWIRTE has used Base64 to decode malicious VBS script.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFIN7 used the command prompt to launch commands on the victim\u2019s machine.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\n3PARA RAT uses HTTP for command and control.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nIndustroyer decrypts code to connect to a remote C2 server.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDDKONG downloads and uploads files on the victim\u2019s machine.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nHTTPBrowser deletes its original installer file once installation is complete.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDiavol has used HTTP GET and POST requests for C2.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAstaroth spawns a CMD process to execute commands.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBumblebee can use `cmd.exe` to drop and run files.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBackConfig has the ability to remove files and folders related to previous infections.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCarberp has connected to C2 servers via HTTP.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAPT38 have enumerated files and directories, or searched in specific locations within a compromised host.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGuLoader can delete its executable from the <code>AppData\\Local\\Temp</code> directory on the compromised host.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAPT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim\u2019s machine.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFunnyDream can delete files including its dropper component.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGet2 has the ability to identify running processes on an infected host.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nClambling can enumerate the IP address of a compromised machine.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nWater Curupira Pikabot Distribution used Curl.exe to download the Pikabot payload from an external server, saving the file to the victim machine's temporary directory.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nThreat Group-3390 actors use NBTscan to discover vulnerable systems.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDacls can scan directories on a compromised host.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBLUELIGHT can enumerate files and collect associated metadata.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAquatic Panda has deleted malicious executables from compromised machines.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBADFLICK can decode shellcode using a custom rotating XOR cipher.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBITTER has downloaded additional malware and tools onto a compromised host.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAcidRain identifies specific files and directories in the Linux operating system associated with storage devices.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nLizar has a plugin designed to obtain a list of processes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nTA551 has used <code>cmd.exe</code> to execute commands.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nEvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nSeveral Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by Lazarus Group also collects disk space information and sends it to its C2 server.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nMacMa can enumerate running processes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nMuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords \"Kasper,\" \"Panda,\" or \"ESET.\"\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nSowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAria-body has the ability to delete files and directories on compromised hosts.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nInnaputRAT gathers volume drive information and system information.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBBK has the ability to download files from C2 to the infected host.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCrackMapExec can enumerate the system drives and associated system name.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nPatchwork removed certain files and replaced them so they could not be retrieved.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nRocke's miner has created UPX-packed files in the Windows Start Menu Folder.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nKGH_SPY can decrypt encrypted strings and write them to a newly created folder.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm -128 key and decoded using a XOR key.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring Frankenstein, the threat actors downloaded files and tools onto a victim machine.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nToddyCat has run `cmd /c start /b tasklist` to enumerate processes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nApostle writes batch scripts to disk, such as <code>system.bat</code> and <code>remover.bat</code>, that perform various anti-analysis and anti-forensic tasks, before finally deleting themselves at the end of execution. Apostle attempts to delete itself after encryption or wiping operations are complete and before shutting down the victim machine.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFELIXROOT adds a shortcut file to the startup folder for persistence.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nEmotet has used a self-extracting RAR file to deliver modules to victims. Emotet has also extracted embedded executables from files using hard-coded buffer offsets.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAPT37's Freenki malware lists running processes using the Microsoft Windows API.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nINC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nHAFNIUM has used `tasklist` to enumerate processes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nOne persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: <br><code>HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\</code> <br><code>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\</code> <br><code>HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run</code> <br><code>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run</code>\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCORESHELL downloads another dropper from its C2 server.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBackdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nLunarMail can decrypt strings to retrieve configuration settings.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFlagpro has dropped an executable file to the startup directory.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDarkTortilla can enumerate a list of running processes on a compromised system.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nHydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nMalteiro collects the machine information, system architecture, the OS version, computer name, and Windows product name.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nApostle compiled code is obfuscated in an unspecified fashion prior to delivery to victims.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDipsind can spawn remote shells.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAPT18 can list files information for specific directories.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nTurla surveys a system upon check-in to discover network configuration details using the <code>arp -a</code>, <code>nbtstat -n</code>, <code>net config</code>, <code>ipconfig /all</code>, and <code>route</code> commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGelsemium can use HTTP/S in C2 communications.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFlawedAmmyy can collect the victim's operating system and computer name during the initial infection.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nEpic uses the <code>tasklist /v</code> command to obtain a list of processes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nRancor has downloaded additional malware, including by using certutil.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCSPY Downloader can download additional tools to a compromised host.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDustySky collects information about running processes from victims.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nINC Ransomware can run `CryptStringToBinaryA` to decrypt base64 content containing its ransom note.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGravityRAT collects the victim IP address, MAC address, as well as the victim account domain name.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCaterpillar WebShell has a module to gather information from the compromrised asset, including the computer version, computer name, IIS version, and more.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nKe3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer  by using the COM interface IWebBrowser2.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDownPaper uses PowerShell to add a Registry Run key in order to establish persistence.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBADFLICK has searched for files on the infected host.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring C0015, the threat actors downloaded additional tools and files onto a compromised network.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nMoonstone Sleet delivered payloads using multiple rounds of obfuscation and encoding to evade defenses and analysis.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nHotCroissant has the ability to list running processes on the infected host.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGeminiDuke collects information on running processes and environment variables from the victim.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nadmin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: <code>dir c:\\ >> %temp%\\download</code> <code>dir \"c:\\Documents and Settings\" >> %temp%\\download</code> <code>dir \"c:\\Program Files\\\" >> %temp%\\download</code> <code>dir d:\\ >> %temp%\\download</code>\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nTonto Team has downloaded malicious DLLs which served as a ShadowPad loader.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring Operation Wocao, the threat actors consistently removed traces of their activity by first overwriting a file using `/c cd /d c:\\windows\\temp\\ & copy \\\\<IP ADDRESS>\\c$\\windows\\system32\\devmgr.dll \\\\<IP ADDRESS>\\c$\\windows\\temp\\LMAKSW.ps1 /y` and then deleting the overwritten file using `/c cd /d c:\\windows\\temp\\ & del \\\\<IP ADDRESS>\\c$\\windows\\temp\\LMAKSW.ps1`.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDarkGate uses the Delphi methods <code>Sysutils::DiskSize</code> and <code>GlobalMemoryStatusEx</code> to collect disk size and physical memory as part of the malware's anti-analysis checks for running in a virtualized environment. DarkGate will gather various system information such as display adapter description, operating system type and version, processor type, and RAM amount.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBoxCaon can collect the victim's MAC address by using the <code>GetAdaptersInfo</code> API.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAgent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nThreat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFELIXROOT uses HTTP and HTTPS to communicate with the C2 server.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nChinoxy has established persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key and by loading a dropper to ``.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nHydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBrute Ratel C4 can download files to compromised hosts.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAuTo Stealer can use HTTP to communicate with its C2 servers.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nWinter Vivern executed PowerShell scripts to create scheduled tasks to retrieve remotely-hosted payloads.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nA dropper used by Putter Panda installs itself into the ASEP Registry key <code>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run</code> with a value named McUpdate.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring Operation Sharpshooter, a first-stage downloader installed Rising Sun to `%Startup%\\mssync.exe` on a compromised host.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCrimson can decode its encoded PE file prior to execution.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nElise is capable of launching a remote shell on the host to delete itself.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nSome versions of DarkGate search for the hard-coded folder <code>C:\\Program Files\\e Carte Bleue</code>.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAvosLocker has searched for files and directories on a compromised network.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDarkGate uses a malicious Windows Batch script to run the Windows <code>code</code> utility to retrieve follow-on script payloads.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDark Caracal's version of Bandook adds a registry key to <code>HKEY_USERS\\Software\\Microsoft\\Windows\\CurrentVersion\\Run</code> for persistence.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nWinter Vivern distributed Windows batch scripts disguised as virus scanners to prompt download of malicious payloads using built-in system tools.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBLUELIGHT can uninstall itself.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDarkTortilla can decrypt its payload and associated configuration elements using the Rijndael cipher.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nOrangeworm has used HTTP for C2.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDarkWatchman has the ability to enumerate file and folder names.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCardinal RAT can download and execute additional payloads.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDaggerfly utilizes victim machine operating system information to create custom User Agent strings for subsequent command and control communication.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nThe IceApple Server Variable Dumper module iterates over all server variables present for the current request and returns them to the adversary.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nChChes collects the victim hostname, window resolution, and Microsoft Windows version.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nIPsec Helper connects to command and control servers via HTTP POST requests based on parameters hard-coded into the malware.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDaserf uses HTTP for C2.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCalisto has the capability to upload and download files to the victim's machine.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAPT28 has deployed malware that has copied itself to the startup directory for persistence.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFlawedAmmyy has used HTTP for C2.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nTeamTNT has used batch scripts to download tools and executing cryptocurrency miners.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring Operation Dream Job, Lazarus Group launched malicious DLL files, created new folders, and renamed folders with the use of the Windows command shell.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nLinfo creates a backdoor through which remote attackers can retrieve a list of running processes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nTropic Trooper has created shortcuts in the Startup folder to establish persistence.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAppleJeus has collected the victim host information after infection.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFIN8 has used HTTPS for command and control.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDEADEYE can run `cmd /c copy /y /b C:\\Users\\public\\syslog_6-*.dat C:\\Users\\public\\syslog.dll` to combine separated sections of code into a single DLL prior to execution.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAPT41 used <code>cmd.exe /c</code> to execute commands on remote machines. APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nKV Botnet Activity removes on-disk copies of tools and other artifacts after it the primary botnet payload has been loaded into memory on the victim device.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBrute Ratel C4 can enumerate all processes and locate specific process IDs .\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBandook has decoded its PowerShell script.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nTeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nEvilBunny has executed C2 commands directly via HTTP.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBLACKCOFFEE has the capability to discover processes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nHigaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBabyShark has used <code>dir</code> to search for \"programfiles\" and \"appdata\".\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring C0017, APT41 used `cmd.exe /c ping %userdomain%` for discovery.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nTeamTNT has enumerated the host machine\u2019s IP address.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nVolt Typhoon has used the Windows command line to perform hands-on-keyboard activities in targeted environments including for discovery.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAvosLocker has discovered system processes by calling `RmGetList`.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nSidewinder has used malware to collect information on network interfaces, including the MAC address.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring Night Dragon, threat actors used HTTP for C2.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nEpic uses the <code>nbtstat -n</code> and <code>nbtstat -s</code> commands on the victim\u2019s machine.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nPatchwork payloads download additional files from the C2 server.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nRedCurl has searched for and collected files on local and network drives.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBoomBox has the ability to download next stage malware components to a compromised system.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nHEXANE has downloaded additional payloads and malicious scripts onto a compromised host.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nTurla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nTeamTNT has added batch scripts to the startup folder.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nVolt Typhoon has downloaded an outdated version of comsvcs.dll to a compromised domain controller in a non-standard folder.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAPT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAria-body has the ability to identify the hostname, computer name, Windows version, processor speed, machine GUID, and disk information on a compromised host.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDarkTortilla has used HTTP and HTTPS for C2.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAria-body has the ability to gather metadata from a file and to search for file and directory names.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAction RAT has the ability to collect drive and file information on an infected machine.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAPT18 uses HTTP for C2 communications.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nWinter Vivern uses HTTP and HTTPS protocols for exfiltration and command and control activity.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nExplosive has used HTTP for communication.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nTurla has used shellcode to download Meterpreter after compromising a victim.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCardinal RAT can execute commands.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nWinter Vivern delivered exploit payloads via base64-encoded payloads in malicious email messages.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBundlore has used <code>openssl</code> to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nRocke has deleted files on infected machines.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAuditCred uses XOR and RC4 to perform decryption on the code functions.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBundlore has used the <code>ps</code> command to list processes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nConti can discover files on a local system.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCookieMiner has used Google Chrome's decryption and extraction operations.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nMuddyWater has used malware to collect the victim\u2019s IP address and domain name.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAn APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nThe reconnaissance modules used with Duqu can collect information on network configuration.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAn APT19 HTTP malware variant establishes persistence by setting the Registry key <code>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Windows Debug Tools-%LOCALAPPDATA%\\</code>.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBLUELIGHT can collect IP information from the victim\u2019s machine.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nMolerats saved malicious files within the AppData and Startup folders to maintain persistence.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nConti can enumerate through all open processes to search for any that have the string \u201csql\u201d in their process name.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nHAFNIUM has used `cmd.exe` to execute commands on the victim's machine.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAkira examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware. These checks are performed through native Windows functions such as <code>GetFileAttributesW</code>.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nSideCopy has identified the IP address of a compromised host.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCyclops Blink can use the Linux API `statvfs` to enumerate the current working directory.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nThreat Group-3390's malware can add a Registry key to `Software\\Microsoft\\Windows\\CurrentVersion\\Run` for persistence.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\ncan collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFoggyWeb has the ability to communicate with C2 servers over HTTP GET/POST requests.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGootloader can create an autorun entry for a PowerShell script to run at reboot.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGazer has commands to delete files and persistence mechanisms from the victim.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFIN10 has executed malicious .bat files containing PowerShell commands.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nTropic Trooper has used a delivered trojan to download additional files.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nTeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFIN5 uses SDelete to clean up the environment and attempt to prevent detection.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nToddyCat has run scripts to enumerate recently modified documents having either a .pdf, .doc, .docx, .xls or .xlsx extension.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDridex has collected the computer name and OS architecture information from the system.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nMagic Hound malware has used Registry Run keys to establish persistence.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBADFLICK has captured victim computer name, memory space, and CPU details.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader. Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAPT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBisonal can obtain a list of running processes on the victim\u2019s machine.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring Operation Dream Job, Lazarus Group downloaded multistage malware and tools onto a compromised host.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nMustang Panda has created the registry key <code>HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\AdobelmdyU</code> to maintain persistence.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nWindshift has used tools to deploy additional payloads to compromised hosts.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCobalt Group deleted the DLL dropper from the victim\u2019s machine to cover their tracks.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAdFind can extract subnet information from Active Directory.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAction RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCARROTBALL has the ability to download and install a remote payload.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nKimsuky has decoded malicious VBScripts using Base64.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nIxeshe has a command to delete a file from the machine.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAmadey can identify the IP address of a victim machine.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBandook has a command to delete a file.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBlackCat can obtain the computer name and UUID, and enumerate local drives.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nTropic Trooper has used scripts to collect the host's network topology.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDUSTTRAP can enumerate running processes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nWindigo has used a script to check for the presence of files created by OpenSSH backdoors.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAvosLocker has been executed via the `RunOnce` Registry key to run itself on safe mode.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDanBot has the ability to execute arbitrary commands via `cmd.exe`.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGALLIUM used <code>ipconfig /all</code> to obtain information about the victim network configuration. The group also ran a modified version of NBTscan to identify available NetBIOS name servers.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAPT3 has a tool that can list out currently running processes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFIN8 has used remote code execution to download subsequent payloads.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCarbanak lists running processes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nLazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card\u2019s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring Operation Honeybee, malicious files were decoded prior to execution.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAPT5 has used Windows-based utilities to carry out tasks including tasklist.exe.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nKessel has decrypted the binary's configuration once the <code>main</code> function was launched.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAuditCred can delete files from the system.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nPatchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nChrommme can decrypt its encrypted internal code.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBUBBLEWRAP can communicate using HTTP or HTTPS.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nMoonstone Sleet has gathered information on victim systems.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAPT3 places scripts in the startup folder for persistence.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDUSTTRAP can execute commands via `cmd.exe`.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGravityRAT collects the MAC address, computer name, and CPU information.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGazer communicates with its C2 servers over HTTP.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nEarth Lusca has used certutil to decode a string into a cabinet file.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nGamaredon Group tools can delete files used during an operation.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nChrommme has the ability to list drives and obtain the computer name of a compromised host.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFunnyDream can parse the `ProxyServer` string in the Registry to discover http proxies.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCatchamas gathers the Mac address, IP address, and the network adapter information from the victim\u2019s machine.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nConti has decrypted its payload using a hardcoded AES-256 key.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCreepyDrive can download files to the compromised host.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring FunnyDream, the threat actors used ipconfig for discovery on remote systems.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nHermeticWiper has the ability to overwrite its own file with random bites.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBazar can decrypt downloaded payloads. Bazar also resolves strings and other artifacts at runtime.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nKazuar gathers information about network adapters.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nKe3chang uses command-line interaction to search files and directories.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nRedCurl has used the Windows Command Prompt to execute commands.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nFerocious can delete files from a compromised host.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCARROTBAT has the ability to execute command line arguments on a compromised host.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nEvilBunny has created Registry keys for persistence in <code>HKLM|HKCU\\\u2026\\CurrentVersion\\Run</code>.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nLater implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nMalteiro has the ability to deobfuscate downloaded files prior to execution.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nSidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nOilRig has run <code>tasklist</code> on a victim's machine.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAttor\u2019s plugin deletes the collected files and log files after exfiltration.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBackdoor.Oldrea collects information about the Internet adapter configuration.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nClambling can browse directories on a compromised host.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring C0017, APT41 issued `ping -n 1 .split-1+` commands to find the volume serial number of compromised systems.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1082"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCarbon can collect the IP address of the victims and other computers on the network using the commands: <code>ipconfig -all</code> <code>nbtstat -n</code>, and <code>nbtstat -s</code>.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBADNEWS is capable of executing commands via cmd.exe.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nChChes establishes persistence by adding a Registry Run key.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBoxCaon can execute arbitrary commands and utilize the \"ComSpec\" environment variable.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nEVILNUM can achieve persistence through the Registry Run key.\n</cti>"}], "ground_truth": "T1547.001", "generated_content": "T1547.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCreepyDrive can specify the local file path to upload files from.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBankshot uses HTTP for command and control communication.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAria-body has used HTTP in C2 communications.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCrimson has the ability to delete files from a compromised host.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nVarious implementations of CHOPSTICK communicate with C2 over HTTP.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring its initial execution, BACKSPACE extracts operating system information from the infected host.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nOne variant of CloudDuke uses HTTP and HTTPS for C2.\n</cti>"}], "ground_truth": "T1071.001", "generated_content": "T1071.001"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDownPaper uses the command line.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBackdoor.Oldrea collects information about running processes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBad Rabbit can enumerate all running processes to compare hashes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nHi-Zor deletes its RAT installer file as it executes its DLL payload file.\n</cti>"}], "ground_truth": "T1070.004", "generated_content": "T1070.004"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nConfucius has used a file stealer that can examine system drives, including those other than the C drive.\n</cti>"}], "ground_truth": "T1082", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nAvenger has the ability to download files from C2 to a compromised host.\n</cti>"}], "ground_truth": "T1105", "generated_content": "T1105"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBackConfig has used a custom routine to decrypt strings.\n</cti>"}], "ground_truth": "T1140", "generated_content": "T1140"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCreepySnail can use `getmac` and `Get-NetIPAddress` to enumerate network settings.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDUSTTRAP can enumerate files and directories.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCrimson contains a command to collect the victim MAC address and LAN IP.\n</cti>"}], "ground_truth": "T1016", "generated_content": "T1016"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nScattered Spider Spider enumerates a target organization for files and directories of interest, including source code.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nOilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nCinnamon Tempest has executed ransomware using batch scripts deployed via GPO.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1059.003"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nConti can utilize command line options to allow an attacker control over how it scans and encrypts files.\n</cti>"}], "ground_truth": "T1059.003", "generated_content": "T1083"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nDuring Frankenstein, the threat actors used Empire to obtain a list of all running processes.\n</cti>"}], "ground_truth": "T1057", "generated_content": "T1057"}
{"messages": [{"role": "user", "content": "What ATT&CK technique does the following CTI procedure sentence describe?\n\n<cti>\nBlackCat can enumerate files for encryption.\n</cti>"}], "ground_truth": "T1083", "generated_content": "T1083"}