id stringlengths 71 71 | task stringclasses 1
value | domain stringclasses 3
values | input dict | target dict | data_scope stringclasses 1
value | provenance dict | split stringclasses 1
value | split_group stringclasses 261
values | split_method stringclasses 1
value |
|---|---|---|---|---|---|---|---|---|---|
security-correlation:relationship--0008005f-ca51-47c3-8369-55ee5de1c65a | security_correlation | mobile-attack | {
"procedure_description": "[SpyNote RAT](https://attack.mitre.org/software/S0305) uses an Android broadcast receiver to automatically start when the device boots.(Citation: Zscaler-SpyNote)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--20dbaf05-59b8-4dc6-8777-0b17f4553a23",
"attack_id": "S0305",
"name": "SpyNote RAT",
"type": "malware",
"url": "https://attack.mitre.org/software/S0305"
},
"target_technique": {
"stix_id": "attack-pattern--3775a580-a1d1-46c... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/mobile-attack/mobile-attack.json",
"source_commit": "... | train | technique:T1624 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--00192a5f-9dc0-445a-b010-d77bd08aac93 | security_correlation | enterprise-attack | {
"procedure_description": "[SombRAT](https://attack.mitre.org/software/S0615) can SSL encrypt C2 traffic.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--425771c5-48b4-4ecd-9f95-74ed3fc9da59",
"attack_id": "S0615",
"name": "SombRAT",
"type": "malware",
"url": "https://attack.mitre.org/software/S0615"
},
"target_technique": {
"stix_id": "attack-pattern--bf176076-b789-408e-8c... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | entity:malware--3ae6097d-d700-46c6-8b21-42fc0bcb48fa | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--0023f0a7-26ae-40ec-ac6e-9dacf5217fb9 | security_correlation | enterprise-attack | {
"procedure_description": "[Cobalt Strike](https://attack.mitre.org/software/S0154) has the ability to accept a value for HTTP Host Header to enable domain fronting.(Citation: Cobalt Strike Manual 4.3 November 2020)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--a7881f21-e978-4fe4-af56-92c9416a2616",
"attack_id": "S0154",
"name": "Cobalt Strike",
"type": "malware",
"url": "https://attack.mitre.org/software/S0154"
},
"target_technique": {
"stix_id": "attack-pattern--ca9d3402-ada3-4... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1090 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--0024d82d-97ea-4dc5-81a1-8738862e1f3b | security_correlation | enterprise-attack | {
"procedure_description": "[Shamoon](https://attack.mitre.org/software/S0140) obtains the system time and will only activate if it is greater than a preset date.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--8901ac23-6b50-410c-b0dd-d8174a86f9b3",
"attack_id": "S0140",
"name": "Shamoon",
"type": "malware",
"url": "https://attack.mitre.org/software/S0140"
},
"target_technique": {
"stix_id": "attack-pattern--f3c544dc-673c-4ef3-ac... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1124 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--0029bcd7-f5f2-410e-84d4-39302d4d1b1f | security_correlation | enterprise-attack | {
"procedure_description": "During [C0027](https://attack.mitre.org/campaigns/C0027), [Scattered Spider](https://attack.mitre.org/groups/G1015) impersonated legitimate IT personnel in phone calls and text messages either to direct victims to a credential harvesting site or getting victims to run commercial remote mon... | {
"relationship": "uses",
"source_entity": {
"stix_id": "campaign--df74f7ad-b10d-431c-9f1d-a2bc18dadefa",
"attack_id": "C0027",
"name": "C0027",
"type": "campaign",
"url": "https://attack.mitre.org/campaigns/C0027"
},
"target_technique": {
"stix_id": "attack-pattern--cd92d2b8-ce43-4666-9... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1585 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--002c9202-d7a0-4181-b912-42f7d6d38339 | security_correlation | enterprise-attack | {
"procedure_description": "[Micropsia](https://attack.mitre.org/software/S0339) gathers the hostname and OS version from the victim’s machine.(Citation: Talos Micropsia June 2017)(Citation: Radware Micropsia July 2018)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--8c050cea-86e1-4b63-bf21-7af4fa483349",
"attack_id": "S0339",
"name": "Micropsia",
"type": "malware",
"url": "https://attack.mitre.org/software/S0339"
},
"target_technique": {
"stix_id": "attack-pattern--354a7f88-63fb-41b5-... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1082 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--002e561a-5500-4293-a876-01e8205a67c8 | security_correlation | enterprise-attack | {
"procedure_description": "During [C0027](https://attack.mitre.org/campaigns/C0027), [Scattered Spider](https://attack.mitre.org/groups/G1015) used SSH tunneling in targeted environments.(Citation: Crowdstrike TELCO BPO Campaign December 2022)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "campaign--df74f7ad-b10d-431c-9f1d-a2bc18dadefa",
"attack_id": "C0027",
"name": "C0027",
"type": "campaign",
"url": "https://attack.mitre.org/campaigns/C0027"
},
"target_technique": {
"stix_id": "attack-pattern--4fe28b27-b13c-453e-a... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | entity:malware--3ae6097d-d700-46c6-8b21-42fc0bcb48fa | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--002f1039-f4c5-4c60-b8ac-ced374bec2ac | security_correlation | enterprise-attack | {
"procedure_description": "[LuminousMoth](https://attack.mitre.org/groups/G1014) has used an unnamed post-exploitation tool to steal cookies from the Chrome browser.(Citation: Kaspersky LuminousMoth July 2021)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "intrusion-set--b7f627e2-0817-4cd5-8d50-e75f8aa85cc6",
"attack_id": "G1014",
"name": "LuminousMoth",
"type": "intrusion-set",
"url": "https://attack.mitre.org/groups/G1014"
},
"target_technique": {
"stix_id": "attack-pattern--10ffac... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1539 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--003071c1-a640-4f29-8405-a3998dfaf11f | security_correlation | enterprise-attack | {
"procedure_description": "[Medusa Group](https://attack.mitre.org/groups/G1051) has deleted recovery files such as shadow copies using `vssadmin.exe`.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Broadcom Medusa Ransomwa... | {
"relationship": "uses",
"source_entity": {
"stix_id": "intrusion-set--918da025-04bd-48af-b6c4-f3e4d1b915eb",
"attack_id": "G1051",
"name": "Medusa Group",
"type": "intrusion-set",
"url": "https://attack.mitre.org/groups/G1051"
},
"target_technique": {
"stix_id": "attack-pattern--f5d8ee... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1490 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--0038b0b8-f51c-4fd1-8b04-2fd7ebd1d61d | security_correlation | enterprise-attack | {
"procedure_description": "[Wizard Spider](https://attack.mitre.org/groups/G0102) has created local administrator accounts to maintain persistence in compromised networks.(Citation: Mandiant FIN12 Oct 2021)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "intrusion-set--dd2d9ca6-505b-4860-a604-233685b802c7",
"attack_id": "G0102",
"name": "Wizard Spider",
"type": "intrusion-set",
"url": "https://attack.mitre.org/groups/G0102"
},
"target_technique": {
"stix_id": "attack-pattern--635cb... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1036 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--003eed51-a560-44f1-9149-5a11bdaebe6f | security_correlation | enterprise-attack | {
"procedure_description": "[BADHATCH](https://attack.mitre.org/software/S1081) can check a user's access to the C$ share on a compromised machine.(Citation: BitDefender BADHATCH Mar 2021) "
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--3553b49d-d4ae-4fb6-ab17-0adbc520c888",
"attack_id": "S1081",
"name": "BADHATCH",
"type": "malware",
"url": "https://attack.mitre.org/software/S1081"
},
"target_technique": {
"stix_id": "attack-pattern--3489cfc5-640f-4bb3-a... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1135 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--0040312a-e85d-4066-8203-2e66f8aa5288 | security_correlation | enterprise-attack | {
"procedure_description": "[RogueRobin](https://attack.mitre.org/software/S0270) establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in.(Citation: Unit 42 DarkHydrus July 2018)(Citation: Unit42 DarkHydrus Jan 2019)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--8ec6e3b4-b06d-4805-b6aa-af916acc2122",
"attack_id": "S0270",
"name": "RogueRobin",
"type": "malware",
"url": "https://attack.mitre.org/software/S0270"
},
"target_technique": {
"stix_id": "attack-pattern--4ab929c6-ee2d-4fb5... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1036 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--0040fdbd-ec7e-49b3-b715-c8c91e08666b | security_correlation | enterprise-attack | {
"procedure_description": "Variants of [Emissary](https://attack.mitre.org/software/S0082) have added Run Registry keys to establish persistence.(Citation: Emissary Trojan Feb 2016)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--0f862b01-99da-47cc-9bdb-db4a86a95bb1",
"attack_id": "S0082",
"name": "Emissary",
"type": "malware",
"url": "https://attack.mitre.org/software/S0082"
},
"target_technique": {
"stix_id": "attack-pattern--9efb1ea7-c37b-4595-9... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1036 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--00490a17-1032-461b-8085-500d56bb80f5 | security_correlation | enterprise-attack | {
"procedure_description": "[Ursnif](https://attack.mitre.org/software/S0386) has gathered information about running services.(Citation: TrendMicro Ursnif Mar 2015)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--1492d0f8-7e14-4af3-9239-bc3fe10d3407",
"attack_id": "S0386",
"name": "Ursnif",
"type": "malware",
"url": "https://attack.mitre.org/software/S0386"
},
"target_technique": {
"stix_id": "attack-pattern--322bad5a-1c49-4d23-ab7... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1007 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--004cc00b-0a84-4783-aa4e-16b47f7465b2 | security_correlation | enterprise-attack | {
"procedure_description": "[Mori](https://attack.mitre.org/software/S1047) can communicate using HTTP over IPv4 or IPv6 depending on a flag set.(Citation: DHS CISA AA22-055A MuddyWater February 2022)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--7e100ca4-e639-48d9-9a9d-8ad84aa7b448",
"attack_id": "S1047",
"name": "Mori",
"type": "malware",
"url": "https://attack.mitre.org/software/S1047"
},
"target_technique": {
"stix_id": "attack-pattern--df8b2a25-8bdf-4856-953c-... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | entity:malware--3ae6097d-d700-46c6-8b21-42fc0bcb48fa | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--0051db4d-9eb9-4b22-93a5-b6593176da75 | security_correlation | enterprise-attack | {
"procedure_description": "[DEADEYE](https://attack.mitre.org/software/S1052) has encrypted its payload.(Citation: Mandiant APT41)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--c46eb8e6-bf29-4696-8008-3ddb0b4ca470",
"attack_id": "S1052",
"name": "DEADEYE",
"type": "malware",
"url": "https://attack.mitre.org/software/S1052"
},
"target_technique": {
"stix_id": "attack-pattern--0d91b3c0-5e50-47c3-94... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1027 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--00561c3c-345e-4578-95c3-b7e0a95db7b1 | security_correlation | enterprise-attack | {
"procedure_description": "[FIN7](https://attack.mitre.org/groups/G0046) has used malicious links to lure victims into downloading malware.(Citation: CrowdStrike Carbon Spider August 2021)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "intrusion-set--3753cc21-2dae-4dfb-8481-d004e74502cc",
"attack_id": "G0046",
"name": "FIN7",
"type": "intrusion-set",
"url": "https://attack.mitre.org/groups/G0046"
},
"target_technique": {
"stix_id": "attack-pattern--ef67e13e-5598-... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1204 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--0057843b-ebe3-43f9-9ae0-90c8bdc802fc | security_correlation | enterprise-attack | {
"procedure_description": "[UNC3886](https://attack.mitre.org/groups/G1048) has replaced atomic indicators mentioned in threat intelligence publications, sometimes as quickly as under a week after release.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "intrusion-set--461b8e25-8f4a-4ea2-a4a8-e39df7ce6630",
"attack_id": "G1048",
"name": "UNC3886",
"type": "intrusion-set",
"url": "https://attack.mitre.org/groups/G1048"
},
"target_technique": {
"stix_id": "attack-pattern--b0533c6e-8f... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1027 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--0059d5e7-7a7f-4a13-8730-00383bad2e98 | security_correlation | enterprise-attack | {
"procedure_description": "[Qilin](https://attack.mitre.org/software/S1242) can employ several code obfuscation methods, including renaming functions, altering control flows, and encrypting strings.(Citation: HC3 Qilin Threat Profile JUN 2024)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--e23d2777-b85d-44fc-861e-9149d399fbb9",
"attack_id": "S1242",
"name": "Qilin",
"type": "malware",
"url": "https://attack.mitre.org/software/S1242"
},
"target_technique": {
"stix_id": "attack-pattern--0d91b3c0-5e50-47c3-949a... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1027 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--005b6fd1-be80-424b-b6df-2ff88d390b1b | security_correlation | enterprise-attack | {
"procedure_description": "[GoldMax](https://attack.mitre.org/software/S0588) has used scheduled tasks to maintain persistence.(Citation: MSTIC NOBELIUM Mar 2021)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--5c747acd-47f0-4c5a-b9e5-213541fc01e0",
"attack_id": "S0588",
"name": "GoldMax",
"type": "malware",
"url": "https://attack.mitre.org/software/S0588"
},
"target_technique": {
"stix_id": "attack-pattern--005a06c6-14bf-4118-af... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1021 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--005cbf7d-9d0b-443b-91db-7b148a1eb55b | security_correlation | enterprise-attack | {
"procedure_description": "[njRAT](https://attack.mitre.org/software/S0385) enumerates the victim operating system and computer name during the initial infection.(Citation: Fidelis njRAT June 2013)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--d906e6f7-434c-44c0-b51a-ed50af8f7945",
"attack_id": "S0385",
"name": "njRAT",
"type": "malware",
"url": "https://attack.mitre.org/software/S0385"
},
"target_technique": {
"stix_id": "attack-pattern--354a7f88-63fb-41b5-a801... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1082 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--0061f7aa-fe4e-41e5-8ebf-e9f526bda08f | security_correlation | enterprise-attack | {
"procedure_description": "[TDTESS](https://attack.mitre.org/software/S0164) creates then deletes log files during installation of itself as a service.(Citation: ClearSky Wilted Tulip July 2017)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--0b32ec39-ba61-4864-9ebe-b4b0b73caf9a",
"attack_id": "S0164",
"name": "TDTESS",
"type": "malware",
"url": "https://attack.mitre.org/software/S0164"
},
"target_technique": {
"stix_id": "attack-pattern--d63a3fb8-9452-4e9d-a60... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1070 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--0068ee65-0945-4f69-ba81-163ffbc05e53 | security_correlation | enterprise-attack | {
"procedure_description": "[WIRTE](https://attack.mitre.org/groups/G0090) has used PowerShell for script execution.(Citation: Lab52 WIRTE Apr 2019)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "intrusion-set--f8cb7b36-62ef-4488-8a6d-a7033e3271c1",
"attack_id": "G0090",
"name": "WIRTE",
"type": "intrusion-set",
"url": "https://attack.mitre.org/groups/G0090"
},
"target_technique": {
"stix_id": "attack-pattern--970a3432-3237... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | entity:malware--3ae6097d-d700-46c6-8b21-42fc0bcb48fa | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--006b3910-e9c3-4de8-ba49-dff36b1a3308 | security_correlation | mobile-attack | {
"procedure_description": "[AbstractEmu](https://attack.mitre.org/software/S1061) can monitor notifications.(Citation: lookout_abstractemu_1021)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--2aec175b-4429-4048-8e09-3ef6cbecfc64",
"attack_id": "S1061",
"name": "AbstractEmu",
"type": "malware",
"url": "https://attack.mitre.org/software/S1061"
},
"target_technique": {
"stix_id": "attack-pattern--39dd7871-f59b-495... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/mobile-attack/mobile-attack.json",
"source_commit": "... | train | technique:T1517 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--006e029e-0714-4f99-befd-53b9fbc7c8c8 | security_correlation | enterprise-attack | {
"procedure_description": "[Maze](https://attack.mitre.org/software/S0449) has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made. [Maze](https://attack.mitre.org/software/S0449) has used the ChaCha algorithm, based on Salsa20, and an RSA algorithm to en... | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--d9f7383c-95ec-4080-bbce-121c9384457b",
"attack_id": "S0449",
"name": "Maze",
"type": "malware",
"url": "https://attack.mitre.org/software/S0449"
},
"target_technique": {
"stix_id": "attack-pattern--b80d107d-fa0d-4b60-9684-... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1486 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--006e52ca-80ac-458a-943e-0595f570fe73 | security_correlation | enterprise-attack | {
"procedure_description": "[Star Blizzard](https://attack.mitre.org/groups/G1033) has registered impersonation email accounts to spoof experts in a particular field or individuals and organizations affiliated with the intended target.(Citation: Microsoft Star Blizzard August 2022)(Citation: CISA Star Blizzard Adviso... | {
"relationship": "uses",
"source_entity": {
"stix_id": "intrusion-set--9b36c218-4d80-4ec6-a68d-cc2886bbe410",
"attack_id": "G1033",
"name": "Star Blizzard",
"type": "intrusion-set",
"url": "https://attack.mitre.org/groups/G1033"
},
"target_technique": {
"stix_id": "attack-pattern--cd92d... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1585 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--006e9850-9213-40c8-bfe0-5dac4383c9c2 | security_correlation | mobile-attack | {
"procedure_description": "[Crocodilus](https://attack.mitre.org/software/S9004) has received instructions and applications through communications with C2 while running.(Citation: ThreatFabric_Crocodilus_March2025) "
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--eed7b988-0279-4c4f-bfa9-d81f5444a04b",
"attack_id": "S9004",
"name": "Crocodilus",
"type": "malware",
"url": "https://attack.mitre.org/software/S9004"
},
"target_technique": {
"stix_id": "attack-pattern--6c49d50f-494d-4150... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/mobile-attack/mobile-attack.json",
"source_commit": "... | train | technique:T1407 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
security-correlation:relationship--00701b4a-9eab-41cc-9c09-f904a9799201 | security_correlation | enterprise-attack | {
"procedure_description": "After initial installation, [Raindrop](https://attack.mitre.org/software/S0565) runs a computation to delay execution.(Citation: Symantec RAINDROP January 2021)"
} | {
"relationship": "uses",
"source_entity": {
"stix_id": "malware--4efc3e00-72f2-466a-ab7c-8a7dc6603b19",
"attack_id": "S0565",
"name": "Raindrop",
"type": "malware",
"url": "https://attack.mitre.org/software/S0565"
},
"target_technique": {
"stix_id": "attack-pattern--4bed873f-0b7d-41d4-b... | Published ATT&CK procedure relationships mapped to entities and techniques; not correlated production incidents or causal attack paths. | {
"publisher": "The MITRE Corporation",
"dataset": "MITRE ATT&CK",
"repository_url": "https://github.com/mitre-attack/attack-stix-data",
"source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack.json",
"source_co... | train | technique:T1083 | sha256(pacifics-v1:canonical_group), 80/10/10 hash buckets; parent/subtechniques grouped globally; exact input prose groups merged |
End of preview. Expand in Data Studio
No dataset card yet
- Downloads last month
- 35