atomic-red-team/atomics/Indexes/Indexes-CSV/linux-index.csv

1	Tactic	Technique #	Technique Name	Test #	Test Name	Test GUID	Executor Name
2	defense-evasion	T1556.003	Pluggable Authentication Modules	1	Malicious PAM rule	4b9dde80-ae22-44b1-a82a-644bf009eb9c	sh
3	defense-evasion	T1556.003	Pluggable Authentication Modules	2	Malicious PAM module	65208808-3125-4a2e-8389-a0a00e9ab326	sh
4	defense-evasion	T1222.002	Linux and Mac File and Directory Permissions Modification	1	chmod - Change file or folder mode (numeric mode)	34ca1464-de9d-40c6-8c77-690adf36a135	bash
5	defense-evasion	T1222.002	Linux and Mac File and Directory Permissions Modification	2	chmod - Change file or folder mode (symbolic mode)	fc9d6695-d022-4a80-91b1-381f5c35aff3	bash
6	defense-evasion	T1222.002	Linux and Mac File and Directory Permissions Modification	3	chmod - Change file or folder mode (numeric mode) recursively	ea79f937-4a4d-4348-ace6-9916aec453a4	bash
7	defense-evasion	T1222.002	Linux and Mac File and Directory Permissions Modification	4	chmod - Change file or folder mode (symbolic mode) recursively	0451125c-b5f6-488f-993b-5a32b09f7d8f	bash
8	defense-evasion	T1222.002	Linux and Mac File and Directory Permissions Modification	5	chown - Change file or folder ownership and group	d169e71b-85f9-44ec-8343-27093ff3dfc0	bash
9	defense-evasion	T1222.002	Linux and Mac File and Directory Permissions Modification	6	chown - Change file or folder ownership and group recursively	b78598be-ff39-448f-a463-adbf2a5b7848	bash
10	defense-evasion	T1222.002	Linux and Mac File and Directory Permissions Modification	7	chown - Change file or folder mode ownership only	967ba79d-f184-4e0e-8d09-6362b3162e99	bash
11	defense-evasion	T1222.002	Linux and Mac File and Directory Permissions Modification	8	chown - Change file or folder ownership recursively	3b015515-b3d8-44e9-b8cd-6fa84faf30b2	bash
12	defense-evasion	T1222.002	Linux and Mac File and Directory Permissions Modification	9	chattr - Remove immutable file attribute	e7469fe2-ad41-4382-8965-99b94dd3c13f	sh
13	defense-evasion	T1222.002	Linux and Mac File and Directory Permissions Modification	10	Chmod through c script	973631cf-6680-4ffa-a053-045e1b6b67ab	sh
14	defense-evasion	T1222.002	Linux and Mac File and Directory Permissions Modification	11	Chown through c script	18592ba1-5f88-4e3c-abc8-ab1c6042e389	sh
15	defense-evasion	T1014	Rootkit	1	Loadable Kernel Module based Rootkit	dfb50072-e45a-4c75-a17e-a484809c8553	sh
16	defense-evasion	T1014	Rootkit	2	Loadable Kernel Module based Rootkit	75483ef8-f10f-444a-bf02-62eb0e48db6f	sh
17	defense-evasion	T1548.003	Sudo and Sudo Caching	1	Sudo usage	150c3a08-ee6e-48a6-aeaf-3659d24ceb4e	sh
18	defense-evasion	T1548.003	Sudo and Sudo Caching	2	Unlimited sudo cache timeout	a7b17659-dd5e-46f7-b7d1-e6792c91d0bc	sh
19	defense-evasion	T1548.003	Sudo and Sudo Caching	3	Disable tty_tickets for sudo caching	91a60b03-fb75-4d24-a42e-2eb8956e8de1	sh
20	defense-evasion	T1036.005	Match Legitimate Name or Location	1	Execute a process from a directory masquerading as the current parent directory.	812c3ab8-94b0-4698-a9bf-9420af23ce24	sh
21	defense-evasion	T1484.002	Domain Trust Modification	1	Add Federation to Azure AD	8906c5d0-3ee5-4f63-897a-f6cafd3fdbb7	powershell
22	defense-evasion	T1497.001	System Checks	1	Detect Virtualization Environment (Linux)	dfbd1a21-540d-4574-9731-e852bd6fe840	sh
23	defense-evasion	T1070.002	Clear Linux or Mac System Logs	1	rm -rf	989cc1b1-3642-4260-a809-54f9dd559683	sh
24	defense-evasion	T1070.002	Clear Linux or Mac System Logs	2	Overwrite Linux Mail Spool	1602ff76-ed7f-4c94-b550-2f727b4782d4	bash
25	defense-evasion	T1070.002	Clear Linux or Mac System Logs	3	Overwrite Linux Log	d304b2dc-90b4-4465-a650-16ddd503f7b5	bash
26	defense-evasion	T1070.003	Clear Command History	1	Clear Bash history (rm)	a934276e-2be5-4a36-93fd-98adbb5bd4fc	sh
27	defense-evasion	T1070.003	Clear Command History	2	Clear Bash history (echo)	cbf506a5-dd78-43e5-be7e-a46b7c7a0a11	sh
28	defense-evasion	T1070.003	Clear Command History	3	Clear Bash history (cat dev/null)	b1251c35-dcd3-4ea1-86da-36d27b54f31f	sh
29	defense-evasion	T1070.003	Clear Command History	4	Clear Bash history (ln dev/null)	23d348f3-cc5c-4ba9-bd0a-ae09069f0914	sh
30	defense-evasion	T1070.003	Clear Command History	5	Clear Bash history (truncate)	47966a1d-df4f-4078-af65-db6d9aa20739	sh
31	defense-evasion	T1070.003	Clear Command History	6	Clear history of a bunch of shells	7e6721df-5f08-4370-9255-f06d8a77af4c	sh
32	defense-evasion	T1070.003	Clear Command History	7	Clear and Disable Bash History Logging	784e4011-bd1a-4ecd-a63a-8feb278512e6	sh
33	defense-evasion	T1070.003	Clear Command History	8	Use Space Before Command to Avoid Logging to History	53b03a54-4529-4992-852d-a00b4b7215a6	sh
34	defense-evasion	T1070.003	Clear Command History	9	Disable Bash History Logging with SSH -T	5f8abd62-f615-43c5-b6be-f780f25790a1	sh
35	defense-evasion	T1140	Deobfuscate/Decode Files or Information	3	Base64 decoding with Python	356dc0e8-684f-4428-bb94-9313998ad608	sh
36	defense-evasion	T1140	Deobfuscate/Decode Files or Information	4	Base64 decoding with Perl	6604d964-b9f6-4d4b-8ce8-499829a14d0a	sh
37	defense-evasion	T1140	Deobfuscate/Decode Files or Information	5	Base64 decoding with shell utilities	b4f6a567-a27a-41e5-b8ef-ac4b4008bb7e	sh
38	defense-evasion	T1140	Deobfuscate/Decode Files or Information	6	Hex decoding with shell utilities	005943f9-8dd5-4349-8b46-0313c0a9f973	sh
39	defense-evasion	T1070.006	Timestomp	1	Set a file's access timestamp	5f9113d5-ed75-47ed-ba23-ea3573d05810	sh
40	defense-evasion	T1070.006	Timestomp	2	Set a file's modification timestamp	20ef1523-8758-4898-b5a2-d026cc3d2c52	sh
41	defense-evasion	T1070.006	Timestomp	3	Set a file's creation timestamp	8164a4a6-f99c-4661-ac4f-80f5e4e78d2b	sh
42	defense-evasion	T1070.006	Timestomp	4	Modify file timestamps using reference file	631ea661-d661-44b0-abdb-7a7f3fc08e50	sh
43	defense-evasion	T1562.004	Disable or Modify System Firewall	7	Stop/Start UFW firewall	fe135572-edcd-49a2-afe6-1d39521c5a9a	sh
44	defense-evasion	T1562.004	Disable or Modify System Firewall	8	Stop/Start UFW firewall systemctl	9fd99609-1854-4f3c-b47b-97d9a5972bd1	sh
45	defense-evasion	T1562.004	Disable or Modify System Firewall	9	Turn off UFW logging	8a95b832-2c2a-494d-9cb0-dc9dd97c8bad	sh
46	defense-evasion	T1562.004	Disable or Modify System Firewall	10	Add and delete UFW firewall rules	b2563a4e-c4b8-429c-8d47-d5bcb227ba7a	sh
47	defense-evasion	T1562.004	Disable or Modify System Firewall	11	Edit UFW firewall user.rules file	beaf815a-c883-4194-97e9-fdbbb2bbdd7c	sh
48	defense-evasion	T1562.004	Disable or Modify System Firewall	12	Edit UFW firewall ufw.conf file	c1d8c4eb-88da-4927-ae97-c7c25893803b	sh
49	defense-evasion	T1562.004	Disable or Modify System Firewall	13	Edit UFW firewall sysctl.conf file	c4ae0701-88d3-4cd8-8bce-4801ed9f97e4	sh
50	defense-evasion	T1562.004	Disable or Modify System Firewall	14	Edit UFW firewall main configuration file	7b697ece-8270-46b5-bbc7-6b9e27081831	sh
51	defense-evasion	T1562.004	Disable or Modify System Firewall	15	Tail the UFW firewall log file	419cca0c-fa52-4572-b0d7-bc7c6f388a27	sh
52	defense-evasion	T1027.001	Binary Padding	1	Pad Binary to Change Hash - Linux/macOS dd	ffe2346c-abd5-4b45-a713-bf5f1ebd573a	sh
53	defense-evasion	T1574.006	Dynamic Linker Hijacking	1	Shared Library Injection via /etc/ld.so.preload	39cb0e67-dd0d-4b74-a74b-c072db7ae991	bash
54	defense-evasion	T1574.006	Dynamic Linker Hijacking	2	Shared Library Injection via LD_PRELOAD	bc219ff7-789f-4d51-9142-ecae3397deae	bash
55	defense-evasion	T1548.001	Setuid and Setgid	1	Make and modify binary from C source	896dfe97-ae43-4101-8e96-9a7996555d80	sh
56	defense-evasion	T1548.001	Setuid and Setgid	2	Set a SetUID flag on file	759055b3-3885-4582-a8ec-c00c9d64dd79	sh
57	defense-evasion	T1548.001	Setuid and Setgid	3	Set a SetGID flag on file	db55f666-7cba-46c6-9fe6-205a05c3242c	sh
58	defense-evasion	T1548.001	Setuid and Setgid	4	Make and modify capabilities of a binary	db53959c-207d-4000-9e7a-cd8eb417e072	sh
59	defense-evasion	T1548.001	Setuid and Setgid	5	Provide the SetUID capability to a file	1ac3272f-9bcf-443a-9888-4b1d3de785c1	sh
60	defense-evasion	T1562.006	Indicator Blocking	1	Auditing Configuration Changes on Linux Host	212cfbcf-4770-4980-bc21-303e37abd0e3	bash
61	defense-evasion	T1562.006	Indicator Blocking	2	Logging Configuration Changes on Linux Host	7d40bc58-94c7-4fbb-88d9-ebce9fcdb60c	bash
62	defense-evasion	T1562.003	Impair Command History Logging	1	Disable history collection	4eafdb45-0f79-4d66-aa86-a3e2c08791f5	sh
63	defense-evasion	T1562.003	Impair Command History Logging	2	Mac HISTCONTROL	468566d5-83e5-40c1-b338-511e1659628d	manual
64	defense-evasion	T1562.001	Disable or Modify Tools	1	Disable syslog	4ce786f8-e601-44b5-bfae-9ebb15a7d1c8	sh
65	defense-evasion	T1562.001	Disable or Modify Tools	2	Disable Cb Response	ae8943f7-0f8d-44de-962d-fbc2e2f03eb8	sh
66	defense-evasion	T1562.001	Disable or Modify Tools	3	Disable SELinux	fc225f36-9279-4c39-b3f9-5141ab74f8d8	sh
67	defense-evasion	T1562.001	Disable or Modify Tools	4	Stop Crowdstrike Falcon on Linux	828a1278-81cc-4802-96ab-188bf29ca77d	sh
68	defense-evasion	T1562.001	Disable or Modify Tools	25	office-365-Disable-AntiPhishRule	b9bbae2c-2ba6-4cf3-b452-8e8f908696f3	powershell
69	defense-evasion	T1027	Obfuscated Files or Information	1	Decode base64 Data into Script	f45df6be-2e1e-4136-a384-8f18ab3826fb	sh
70	defense-evasion	T1036.003	Rename System Utilities	2	Masquerading as Linux crond process.	a315bfff-7a98-403b-b442-2ea1b255e556	sh
71	defense-evasion	T1553.004	Install Root Certificate	1	Install root CA on CentOS/RHEL	9c096ec4-fd42-419d-a762-d64cc950627e	sh
72	defense-evasion	T1553.004	Install Root Certificate	2	Install root CA on Debian/Ubuntu	53bcf8a0-1549-4b85-b919-010c56d724ff	sh
73	defense-evasion	T1027.004	Compile After Delivery	3	C compile	d0377aa6-850a-42b2-95f0-de558d80be57	bash
74	defense-evasion	T1027.004	Compile After Delivery	4	CC compile	da97bb11-d6d0-4fc1-b445-e443d1346efe	bash
75	defense-evasion	T1027.004	Compile After Delivery	5	Go compile	78bd3fa7-773c-449e-a978-dc1f1500bc52	bash
76	defense-evasion	T1562.008	Disable Cloud Logs	1	AWS CloudTrail Changes	9c10dc6b-20bd-403a-8e67-50ef7d07ed4e	sh
77	defense-evasion	T1562.008	Disable Cloud Logs	2	Azure - Eventhub Deletion	5e09bed0-7d33-453b-9bf3-caea32bff719	powershell
78	defense-evasion	T1562.008	Disable Cloud Logs	3	Office 365 - Exchange Audit Log Disabled	1ee572f3-056c-4632-a7fc-7e7c42b1543c	powershell
79	defense-evasion	T1562.008	Disable Cloud Logs	4	Disable CloudTrail Logging Through Event Selectors via Stratus	a27418de-bdce-4ebd-b655-38f11142bf0c	sh
80	defense-evasion	T1562.008	Disable Cloud Logs	5	AWS CloudWatch Log Group Deletes	89422c87-b57b-4a04-a8ca-802bb9d06121	sh
81	defense-evasion	T1562.008	Disable Cloud Logs	6	AWS CloudWatch Log Stream Deletes	33ca84bc-4259-4943-bd36-4655dc420932	sh
82	defense-evasion	T1070.004	File Deletion	1	Delete a single file - Linux/macOS	562d737f-2fc6-4b09-8c2a-7f8ff0828480	sh
83	defense-evasion	T1070.004	File Deletion	2	Delete an entire folder - Linux/macOS	a415f17e-ce8d-4ce2-a8b4-83b674e7017e	sh
84	defense-evasion	T1070.004	File Deletion	3	Overwrite and delete a file with shred	039b4b10-2900-404b-b67f-4b6d49aa6499	sh
85	defense-evasion	T1070.004	File Deletion	8	Delete Filesystem - Linux	f3aa95fe-4f10-4485-ad26-abf22a764c52	bash
86	defense-evasion	T1027.002	Software Packing	1	Binary simply packed by UPX (linux)	11c46cd8-e471-450e-acb8-52a1216ae6a4	sh
87	defense-evasion	T1027.002	Software Packing	2	Binary packed by UPX, with modified headers (linux)	f06197f8-ff46-48c2-a0c6-afc1b50665e1	sh
88	defense-evasion	T1036.006	Space after Filename	2	Space After Filename	b95ce2eb-a093-4cd8-938d-5258cef656ea	bash
89	defense-evasion	T1564.001	Hidden Files and Directories	1	Create a hidden file in a hidden directory	61a782e5-9a19-40b5-8ba4-69a4b9f3d7be	sh
90	defense-evasion	T1078.004	Cloud Accounts	1	Creating GCP Service Account and Service Account Key	9fdd83fd-bd53-46e5-a716-9dec89c8ae8e	gcloud
91	collection	T1560.001	Archive via Utility	5	Data Compressed - nix - zip	c51cec55-28dd-4ad2-9461-1eacbc82c3a0	sh
92	collection	T1560.001	Archive via Utility	6	Data Compressed - nix - gzip Single File	cde3c2af-3485-49eb-9c1f-0ed60e9cc0af	sh
93	collection	T1560.001	Archive via Utility	7	Data Compressed - nix - tar Folder or File	7af2b51e-ad1c-498c-aca8-d3290c19535a	sh
94	collection	T1560.001	Archive via Utility	8	Data Encrypted with zip and gpg symmetric	0286eb44-e7ce-41a0-b109-3da516e05a5f	sh
95	collection	T1113	Screen Capture	3	X Windows Capture	8206dd0c-faf6-4d74-ba13-7fbe13dce6ac	bash
96	collection	T1113	Screen Capture	4	Capture Linux Desktop using Import Tool	9cd1cccb-91e4-4550-9139-e20a586fcea1	bash
97	collection	T1056.001	Keylogging	2	Living off the land Terminal Input Capture on Linux with pam.d	9c6bdb34-a89f-4b90-acb1-5970614c711b	sh
98	collection	T1056.001	Keylogging	3	Logging bash history to syslog	0e59d59d-3265-4d35-bebd-bf5c1ec40db5	sh
99	collection	T1056.001	Keylogging	4	Bash session based keylogger	7f85a946-a0ea-48aa-b6ac-8ff539278258	sh
100	collection	T1056.001	Keylogging	5	SSHD PAM keylogger	81d7d2ad-d644-4b6a-bea7-28ffe43becca	sh
101	collection	T1056.001	Keylogging	6	Auditd keylogger	a668edb9-334e-48eb-8c2e-5413a40867af	sh
102	collection	T1074.001	Local Data Staging	2	Stage data from Discovery.sh	39ce0303-ae16-4b9e-bb5b-4f53e8262066	bash
103	collection	T1530	Data from Cloud Storage Object	1	Azure - Enumerate Azure Blobs with MicroBurst	3dab4bcc-667f-4459-aea7-4162dd2d6590	powershell
104	collection	T1530	Data from Cloud Storage Object	2	Azure - Scan for Anonymous Access to Azure Storage (Powershell)	146af1f1-b74e-4aa7-9895-505eb559b4b0	powershell
105	collection	T1560.002	Archive via Library	1	Compressing data using GZip in Python (Linux)	391f5298-b12d-4636-8482-35d9c17d53a8	bash
106	collection	T1560.002	Archive via Library	2	Compressing data using bz2 in Python (Linux)	c75612b2-9de0-4d7c-879c-10d7b077072d	bash
107	collection	T1560.002	Archive via Library	3	Compressing data using zipfile in Python (Linux)	001a042b-859f-44d9-bf81-fd1c4e2200b0	bash
108	collection	T1560.002	Archive via Library	4	Compressing data using tarfile in Python (Linux)	e86f1b4b-fcc1-4a2a-ae10-b49da01458db	bash
109	persistence	T1556.003	Pluggable Authentication Modules	1	Malicious PAM rule	4b9dde80-ae22-44b1-a82a-644bf009eb9c	sh
110	persistence	T1556.003	Pluggable Authentication Modules	2	Malicious PAM module	65208808-3125-4a2e-8389-a0a00e9ab326	sh
111	persistence	T1053.007	Container Orchestration Job	1	ListCronjobs	ddfb0bc1-3c3f-47e9-a298-550ecfefacbd	bash
112	persistence	T1053.007	Container Orchestration Job	2	CreateCronjob	f2fa019e-fb2a-4d28-9dc6-fd1a9b7f68c3	bash
113	persistence	T1053.003	Cron	1	Cron - Replace crontab with referenced file	435057fb-74b1-410e-9403-d81baf194f75	bash
114	persistence	T1053.003	Cron	2	Cron - Add script to all cron subfolders	b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0	bash
115	persistence	T1053.003	Cron	3	Cron - Add script to /var/spool/cron/crontabs/ folder	2d943c18-e74a-44bf-936f-25ade6cccab4	bash
116	persistence	T1176	Browser Extensions	1	Chrome (Developer Mode)	3ecd790d-2617-4abf-9a8c-4e8d47da9ee1	manual
117	persistence	T1176	Browser Extensions	2	Chrome (Chrome Web Store)	4c83940d-8ca5-4bb2-8100-f46dc914bc3f	manual
118	persistence	T1176	Browser Extensions	3	Firefox	cb790029-17e6-4c43-b96f-002ce5f10938	manual
119	persistence	T1546.005	Trap	1	Trap	a74b2e07-5952-4c03-8b56-56274b076b61	sh
120	persistence	T1574.006	Dynamic Linker Hijacking	1	Shared Library Injection via /etc/ld.so.preload	39cb0e67-dd0d-4b74-a74b-c072db7ae991	bash
121	persistence	T1574.006	Dynamic Linker Hijacking	2	Shared Library Injection via LD_PRELOAD	bc219ff7-789f-4d51-9142-ecae3397deae	bash
122	persistence	T1136.001	Local Account	1	Create a user account on a Linux system	40d8eabd-e394-46f6-8785-b9bfa1d011d2	bash
123	persistence	T1136.001	Local Account	5	Create a new user in Linux with `root` UID and GID.	a1040a30-d28b-4eda-bd99-bb2861a4616c	bash
124	persistence	T1098.004	SSH Authorized Keys	1	Modify SSH Authorized Keys	342cc723-127c-4d3a-8292-9c0c6b4ecadc	bash
125	persistence	T1098.001	Additional Cloud Credentials	1	Azure AD Application Hijacking - Service Principal	b8e747c3-bdf7-4d71-bce2-f1df2a057406	powershell
126	persistence	T1098.001	Additional Cloud Credentials	2	Azure AD Application Hijacking - App Registration	a12b5531-acab-4618-a470-0dafb294a87a	powershell
127	persistence	T1098.001	Additional Cloud Credentials	3	AWS - Create Access Key and Secret Key	8822c3b0-d9f9-4daf-a043-491160a31122	sh
128	persistence	T1136.003	Cloud Account	1	AWS - Create a new IAM user	8d1c2368-b503-40c9-9057-8e42f21c58ad	sh
129	persistence	T1098	Account Manipulation	3	AWS - Create a group and add a user to that group	8822c3b0-d9f9-4daf-a043-49f110a31122	sh
130	persistence	T1098	Account Manipulation	4	Azure - adding user to Azure AD role	0e65ae27-5385-46b4-98ac-607a8ee82261	powershell
131	persistence	T1098	Account Manipulation	5	Azure - adding service principal to Azure AD role	92c40b3f-c406-4d1f-8d2b-c039bf5009e4	powershell
132	persistence	T1098	Account Manipulation	6	Azure - adding user to Azure role in subscription	1a94b3fc-b080-450a-b3d8-6d9b57b472ea	powershell
133	persistence	T1098	Account Manipulation	7	Azure - adding service principal to Azure role in subscription	c8f4bc29-a151-48da-b3be-4680af56f404	powershell
134	persistence	T1098	Account Manipulation	8	AzureAD - adding permission to application	94ea9cc3-81f9-4111-8dde-3fb54f36af4b	powershell
135	persistence	T1547.006	Kernel Modules and Extensions	1	Linux - Load Kernel Module via insmod	687dcb93-9656-4853-9c36-9977315e9d23	bash
136	persistence	T1053.006	Systemd Timers	1	Create Systemd Service and Timer	f4983098-bb13-44fb-9b2c-46149961807b	bash
137	persistence	T1053.006	Systemd Timers	2	Create a user level transient systemd service and timer	3de33f5b-62e5-4e63-a2a0-6fd8808c80ec	sh
138	persistence	T1053.006	Systemd Timers	3	Create a system level transient systemd service and timer	d3eda496-1fc0-49e9-aff5-3bec5da9fa22	sh
139	persistence	T1546.004	Unix Shell Configuration Modification	1	Add command to .bash_profile	94500ae1-7e31-47e3-886b-c328da46872f	sh
140	persistence	T1546.004	Unix Shell Configuration Modification	2	Add command to .bashrc	0a898315-4cfa-4007-bafe-33a4646d115f	sh
141	persistence	T1037.004	RC Scripts	2	rc.common	c33f3d80-5f04-419b-a13a-854d1cbdbf3a	bash
142	persistence	T1037.004	RC Scripts	3	rc.local	126f71af-e1c9-405c-94ef-26a47b16c102	bash
143	persistence	T1543.002	Systemd Service	1	Create Systemd Service	d9e4f24f-aa67-4c6e-bcbf-85622b697a7c	bash
144	persistence	T1543.002	Systemd Service	2	Create Systemd Service file, Enable the service , Modify and Reload the service.	c35ac4a8-19de-43af-b9f8-755da7e89c89	bash
145	persistence	T1078.004	Cloud Accounts	1	Creating GCP Service Account and Service Account Key	9fdd83fd-bd53-46e5-a716-9dec89c8ae8e	gcloud
146	persistence	T1053.002	At	2	At - Schedule a job	7266d898-ac82-4ec0-97c7-436075d0d08e	sh
147	privilege-escalation	T1053.007	Container Orchestration Job	1	ListCronjobs	ddfb0bc1-3c3f-47e9-a298-550ecfefacbd	bash
148	privilege-escalation	T1053.007	Container Orchestration Job	2	CreateCronjob	f2fa019e-fb2a-4d28-9dc6-fd1a9b7f68c3	bash
149	privilege-escalation	T1548.003	Sudo and Sudo Caching	1	Sudo usage	150c3a08-ee6e-48a6-aeaf-3659d24ceb4e	sh
150	privilege-escalation	T1548.003	Sudo and Sudo Caching	2	Unlimited sudo cache timeout	a7b17659-dd5e-46f7-b7d1-e6792c91d0bc	sh
151	privilege-escalation	T1548.003	Sudo and Sudo Caching	3	Disable tty_tickets for sudo caching	91a60b03-fb75-4d24-a42e-2eb8956e8de1	sh
152	privilege-escalation	T1484.002	Domain Trust Modification	1	Add Federation to Azure AD	8906c5d0-3ee5-4f63-897a-f6cafd3fdbb7	powershell
153	privilege-escalation	T1053.003	Cron	1	Cron - Replace crontab with referenced file	435057fb-74b1-410e-9403-d81baf194f75	bash
154	privilege-escalation	T1053.003	Cron	2	Cron - Add script to all cron subfolders	b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0	bash
155	privilege-escalation	T1053.003	Cron	3	Cron - Add script to /var/spool/cron/crontabs/ folder	2d943c18-e74a-44bf-936f-25ade6cccab4	bash
156	privilege-escalation	T1611	Escape to Host	1	Deploy container using nsenter container escape	0b2f9520-a17a-4671-9dba-3bd034099fff	sh
157	privilege-escalation	T1611	Escape to Host	2	Mount host filesystem to escape privileged Docker container	6c499943-b098-4bc6-8d38-0956fc182984	sh
158	privilege-escalation	T1546.005	Trap	1	Trap	a74b2e07-5952-4c03-8b56-56274b076b61	sh
159	privilege-escalation	T1574.006	Dynamic Linker Hijacking	1	Shared Library Injection via /etc/ld.so.preload	39cb0e67-dd0d-4b74-a74b-c072db7ae991	bash
160	privilege-escalation	T1574.006	Dynamic Linker Hijacking	2	Shared Library Injection via LD_PRELOAD	bc219ff7-789f-4d51-9142-ecae3397deae	bash
161	privilege-escalation	T1548.001	Setuid and Setgid	1	Make and modify binary from C source	896dfe97-ae43-4101-8e96-9a7996555d80	sh
162	privilege-escalation	T1548.001	Setuid and Setgid	2	Set a SetUID flag on file	759055b3-3885-4582-a8ec-c00c9d64dd79	sh
163	privilege-escalation	T1548.001	Setuid and Setgid	3	Set a SetGID flag on file	db55f666-7cba-46c6-9fe6-205a05c3242c	sh
164	privilege-escalation	T1548.001	Setuid and Setgid	4	Make and modify capabilities of a binary	db53959c-207d-4000-9e7a-cd8eb417e072	sh
165	privilege-escalation	T1548.001	Setuid and Setgid	5	Provide the SetUID capability to a file	1ac3272f-9bcf-443a-9888-4b1d3de785c1	sh
166	privilege-escalation	T1547.006	Kernel Modules and Extensions	1	Linux - Load Kernel Module via insmod	687dcb93-9656-4853-9c36-9977315e9d23	bash
167	privilege-escalation	T1053.006	Systemd Timers	1	Create Systemd Service and Timer	f4983098-bb13-44fb-9b2c-46149961807b	bash
168	privilege-escalation	T1053.006	Systemd Timers	2	Create a user level transient systemd service and timer	3de33f5b-62e5-4e63-a2a0-6fd8808c80ec	sh
169	privilege-escalation	T1053.006	Systemd Timers	3	Create a system level transient systemd service and timer	d3eda496-1fc0-49e9-aff5-3bec5da9fa22	sh
170	privilege-escalation	T1546.004	Unix Shell Configuration Modification	1	Add command to .bash_profile	94500ae1-7e31-47e3-886b-c328da46872f	sh
171	privilege-escalation	T1546.004	Unix Shell Configuration Modification	2	Add command to .bashrc	0a898315-4cfa-4007-bafe-33a4646d115f	sh
172	privilege-escalation	T1037.004	RC Scripts	2	rc.common	c33f3d80-5f04-419b-a13a-854d1cbdbf3a	bash
173	privilege-escalation	T1037.004	RC Scripts	3	rc.local	126f71af-e1c9-405c-94ef-26a47b16c102	bash
174	privilege-escalation	T1543.002	Systemd Service	1	Create Systemd Service	d9e4f24f-aa67-4c6e-bcbf-85622b697a7c	bash
175	privilege-escalation	T1543.002	Systemd Service	2	Create Systemd Service file, Enable the service , Modify and Reload the service.	c35ac4a8-19de-43af-b9f8-755da7e89c89	bash
176	privilege-escalation	T1078.004	Cloud Accounts	1	Creating GCP Service Account and Service Account Key	9fdd83fd-bd53-46e5-a716-9dec89c8ae8e	gcloud
177	privilege-escalation	T1053.002	At	2	At - Schedule a job	7266d898-ac82-4ec0-97c7-436075d0d08e	sh
178	credential-access	T1556.003	Pluggable Authentication Modules	1	Malicious PAM rule	4b9dde80-ae22-44b1-a82a-644bf009eb9c	sh
179	credential-access	T1556.003	Pluggable Authentication Modules	2	Malicious PAM module	65208808-3125-4a2e-8389-a0a00e9ab326	sh
180	credential-access	T1056.001	Keylogging	2	Living off the land Terminal Input Capture on Linux with pam.d	9c6bdb34-a89f-4b90-acb1-5970614c711b	sh
181	credential-access	T1056.001	Keylogging	3	Logging bash history to syslog	0e59d59d-3265-4d35-bebd-bf5c1ec40db5	sh
182	credential-access	T1056.001	Keylogging	4	Bash session based keylogger	7f85a946-a0ea-48aa-b6ac-8ff539278258	sh
183	credential-access	T1056.001	Keylogging	5	SSHD PAM keylogger	81d7d2ad-d644-4b6a-bea7-28ffe43becca	sh
184	credential-access	T1056.001	Keylogging	6	Auditd keylogger	a668edb9-334e-48eb-8c2e-5413a40867af	sh
185	credential-access	T1110.001	Password Guessing	3	Brute Force Credentials of single Azure AD user	5a51ef57-299e-4d62-8e11-2d440df55e69	powershell
186	credential-access	T1110.001	Password Guessing	4	SUDO brute force Debian	464b63e8-bf1f-422e-9e2c-2aa5080b6f9a	sh
187	credential-access	T1110.001	Password Guessing	5	SUDO brute force Redhat	b72958a7-53e3-4809-9ee1-58f6ecd99ade	sh
188	credential-access	T1552.005	Cloud Instance Metadata API	1	Azure - Search Azure AD User Attributes for Passwords	ae9b2e3e-efa1-4483-86e2-fae529ab9fb6	powershell
189	credential-access	T1606.002	SAML Tokens	1	Golden SAML	b16a03bc-1089-4dcc-ad98-30fe8f3a2b31	powershell
190	credential-access	T1003.007	Proc Filesystem	1	Dump individual process memory with sh (Local)	7e91138a-8e74-456d-a007-973d67a0bb80	sh
191	credential-access	T1003.007	Proc Filesystem	2	Dump individual process memory with Python (Local)	437b2003-a20d-4ed8-834c-4964f24eec63	sh
192	credential-access	T1003.007	Proc Filesystem	3	Capture Passwords with MimiPenguin	a27418de-bdce-4ebd-b655-38f04842bf0c	bash
193	credential-access	T1040	Network Sniffing	1	Packet Capture Linux	7fe741f7-b265-4951-a7c7-320889083b3e	bash
194	credential-access	T1555.003	Credentials from Web Browsers	9	LaZagne.py - Dump Credentials from Firefox Browser	87e88698-621b-4c45-8a89-4eaebdeaabb1	sh
195	credential-access	T1552.004	Private Keys	2	Discover Private SSH Keys	46959285-906d-40fa-9437-5a439accd878	sh
196	credential-access	T1552.004	Private Keys	3	Copy Private SSH Keys with CP	7c247dc7-5128-4643-907b-73a76d9135c3	sh
197	credential-access	T1552.004	Private Keys	4	Copy Private SSH Keys with rsync	864bb0b2-6bb5-489a-b43b-a77b3a16d68a	sh
198	credential-access	T1552.004	Private Keys	5	Copy the users GnuPG directory with rsync	2a5a0601-f5fb-4e2e-aa09-73282ae6afca	sh
199	credential-access	T1110.003	Password Spraying	4	Password spray all Azure AD users with a single password	a8aa2d3e-1c52-4016-bc73-0f8854cfa80a	powershell
200	credential-access	T1110.003	Password Spraying	7	Password Spray Microsoft Online Accounts with MSOLSpray (Azure/O365)	f3a10056-0160-4785-8744-d9bd7c12dc39	powershell
201	credential-access	T1552.003	Bash History	1	Search Through Bash History	3cfde62b-7c33-4b26-a61e-755d6131c8ce	sh
202	credential-access	T1552.001	Credentials In Files	2	Extract passwords with grep	bd4cf0d1-7646-474e-8610-78ccf5a097c4	sh
203	credential-access	T1552.001	Credentials In Files	5	Find and Access Github Credentials	da4f751a-020b-40d7-b9ff-d433b7799803	bash
204	credential-access	T1110.004	Credential Stuffing	1	SSH Credential Stuffing From Linux	4f08197a-2a8a-472d-9589-cd2895ef22ad	bash
205	credential-access	T1003.008	/etc/passwd and /etc/shadow	1	Access /etc/shadow (Local)	3723ab77-c546-403c-8fb4-bb577033b235	bash
206	credential-access	T1003.008	/etc/passwd and /etc/shadow	2	Access /etc/passwd (Local)	60e860b6-8ae6-49db-ad07-5e73edd88f5d	sh
207	credential-access	T1003.008	/etc/passwd and /etc/shadow	3	Access /etc/{shadow,passwd} with a standard bin that's not cat	df1a55ae-019d-4120-bc35-94f4bc5c4b0a	bash
208	credential-access	T1003.008	/etc/passwd and /etc/shadow	4	Access /etc/{shadow,passwd} with shell builtins	f5aa6543-6cb2-4fae-b9c2-b96e14721713	bash
209	credential-access	T1552.007	Container API	1	ListSecrets	43c3a49d-d15c-45e6-b303-f6e177e44a9a	bash
210	credential-access	T1552.007	Container API	2	Cat the contents of a Kubernetes service account token file	788e0019-a483-45da-bcfe-96353d46820f	sh
211	discovery	T1033	System Owner/User Discovery	2	System Owner/User Discovery	2a9b677d-a230-44f4-ad86-782df1ef108c	sh
212	discovery	T1087.001	Local Account	1	Enumerate all accounts (Local)	f8aab3dd-5990-4bf8-b8ab-2226c951696f	sh
213	discovery	T1087.001	Local Account	2	View sudoers access	fed9be70-0186-4bde-9f8a-20945f9370c2	sh
214	discovery	T1087.001	Local Account	3	View accounts with UID 0	c955a599-3653-4fe5-b631-f11c00eb0397	sh
215	discovery	T1087.001	Local Account	4	List opened files by user	7e46c7a5-0142-45be-a858-1a3ecb4fd3cb	sh
216	discovery	T1087.001	Local Account	5	Show if a user account has ever logged in remotely	0f0b6a29-08c3-44ad-a30b-47fd996b2110	sh
217	discovery	T1087.001	Local Account	6	Enumerate users and groups	e6f36545-dc1e-47f0-9f48-7f730f54a02e	sh
218	discovery	T1497.001	System Checks	1	Detect Virtualization Environment (Linux)	dfbd1a21-540d-4574-9731-e852bd6fe840	sh
219	discovery	T1007	System Service Discovery	3	System Service Discovery - systemctl	f4b26bce-4c2c-46c0-bcc5-fce062d38bef	bash
220	discovery	T1040	Network Sniffing	1	Packet Capture Linux	7fe741f7-b265-4951-a7c7-320889083b3e	bash
221	discovery	T1135	Network Share Discovery	2	Network Share Discovery - linux	875805bc-9e86-4e87-be86-3a5527315cae	bash
222	discovery	T1082	System Information Discovery	3	List OS Information	cccb070c-df86-4216-a5bc-9fb60c74e27c	sh
223	discovery	T1082	System Information Discovery	4	Linux VM Check via Hardware	31dad7ad-2286-4c02-ae92-274418c85fec	bash
224	discovery	T1082	System Information Discovery	5	Linux VM Check via Kernel Modules	8057d484-0fae-49a4-8302-4812c4f1e64e	bash
225	discovery	T1082	System Information Discovery	7	Hostname Discovery	486e88ea-4f56-470f-9b57-3f4d73f39133	bash
226	discovery	T1082	System Information Discovery	11	Environment variables discovery on macos and linux	fcbdd43f-f4ad-42d5-98f3-0218097e2720	sh
227	discovery	T1082	System Information Discovery	23	Azure Security Scan with SkyArk	26a18d3d-f8bc-486b-9a33-d6df5d78a594	powershell
228	discovery	T1217	Browser Bookmark Discovery	1	List Mozilla Firefox Bookmark Database Files on Linux	3a41f169-a5ab-407f-9269-abafdb5da6c2	sh
229	discovery	T1016	System Network Configuration Discovery	3	System Network Configuration Discovery	c141bbdb-7fca-4254-9fd6-f47e79447e17	sh
230	discovery	T1083	File and Directory Discovery	3	Nix File and Directory Discovery	ffc8b249-372a-4b74-adcd-e4c0430842de	sh
231	discovery	T1083	File and Directory Discovery	4	Nix File and Directory Discovery 2	13c5e1ae-605b-46c4-a79f-db28c77ff24e	sh
232	discovery	T1049	System Network Connections Discovery	3	System Network Connections Discovery Linux & MacOS	9ae28d3f-190f-4fa0-b023-c7bd3e0eabf2	sh
233	discovery	T1057	Process Discovery	1	Process Discovery - ps	4ff64f0b-aaf2-4866-b39d-38d9791407cc	sh
234	discovery	T1069.001	Local Groups	1	Permission Groups Discovery (Local)	952931a4-af0b-4335-bbbe-73c8c5b327ae	sh
235	discovery	T1201	Password Policy Discovery	1	Examine password complexity policy - Ubuntu	085fe567-ac84-47c7-ac4c-2688ce28265b	bash
236	discovery	T1201	Password Policy Discovery	2	Examine password complexity policy - CentOS/RHEL 7.x	78a12e65-efff-4617-bc01-88f17d71315d	bash
237	discovery	T1201	Password Policy Discovery	3	Examine password complexity policy - CentOS/RHEL 6.x	6ce12552-0adb-4f56-89ff-95ce268f6358	bash
238	discovery	T1201	Password Policy Discovery	4	Examine password expiration policy - All Linux	7c86c55c-70fa-4a05-83c9-3aa19b145d1a	bash
239	discovery	T1518.001	Security Software Discovery	4	Security Software Discovery - ps (Linux)	23b91cd2-c99c-4002-9e41-317c63e024a2	sh
240	discovery	T1526	Cloud Service Discovery	1	Azure - Dump Subscription Data with MicroBurst	1e40bb1d-195e-401e-a86b-c192f55e005c	powershell
241	discovery	T1018	Remote System Discovery	6	Remote System Discovery - arp nix	acb6b1ff-e2ad-4d64-806c-6c35fe73b951	sh
242	discovery	T1018	Remote System Discovery	7	Remote System Discovery - sweep	96db2632-8417-4dbb-b8bb-a8b92ba391de	sh
243	discovery	T1018	Remote System Discovery	12	Remote System Discovery - ip neighbour	158bd4dd-6359-40ab-b13c-285b9ef6fa25	sh
244	discovery	T1018	Remote System Discovery	13	Remote System Discovery - ip route	1a4ebe70-31d0-417b-ade2-ef4cb3e7d0e1	sh
245	discovery	T1018	Remote System Discovery	14	Remote System Discovery - ip tcp_metrics	6c2da894-0b57-43cb-87af-46ea3b501388	sh
246	discovery	T1046	Network Service Discovery	1	Port Scan	68e907da-2539-48f6-9fc9-257a78c05540	bash
247	discovery	T1046	Network Service Discovery	2	Port Scan Nmap	515942b0-a09f-4163-a7bb-22fefb6f185f	sh
248	command-and-control	T1132.001	Standard Encoding	1	Base64 Encoded data.	1164f70f-9a88-4dff-b9ff-dc70e7bf0c25	sh
249	command-and-control	T1090.003	Multi-hop Proxy	3	Tor Proxy Usage - Debian/Ubuntu	5ff9d047-6e9c-4357-b39b-5cf89d9b59c7	sh
250	command-and-control	T1571	Non-Standard Port	2	Testing usage of uncommonly used port	5db21e1d-dd9c-4a50-b885-b1e748912767	sh
251	command-and-control	T1071.001	Web Protocols	3	Malicious User Agents - Nix	2d7c471a-e887-4b78-b0dc-b0df1f2e0658	sh
252	command-and-control	T1105	Ingress Tool Transfer	1	rsync remote file copy (push)	0fc6e977-cb12-44f6-b263-2824ba917409	bash
253	command-and-control	T1105	Ingress Tool Transfer	2	rsync remote file copy (pull)	3180f7d5-52c0-4493-9ea0-e3431a84773f	bash
254	command-and-control	T1105	Ingress Tool Transfer	3	scp remote file copy (push)	83a49600-222b-4866-80a0-37736ad29344	bash
255	command-and-control	T1105	Ingress Tool Transfer	4	scp remote file copy (pull)	b9d22b9a-9778-4426-abf0-568ea64e9c33	bash
256	command-and-control	T1105	Ingress Tool Transfer	5	sftp remote file copy (push)	f564c297-7978-4aa9-b37a-d90477feea4e	bash
257	command-and-control	T1105	Ingress Tool Transfer	6	sftp remote file copy (pull)	0139dba1-f391-405e-a4f5-f3989f2c88ef	bash
258	command-and-control	T1105	Ingress Tool Transfer	14	whois file download	c99a829f-0bb8-4187-b2c6-d47d1df74cab	sh
259	command-and-control	T1090.001	Internal Proxy	1	Connection Proxy	0ac21132-4485-4212-a681-349e8a6637cd	sh
260	impact	T1486	Data Encrypted for Impact	1	Encrypt files using gpg (Linux)	7b8ce084-3922-4618-8d22-95f996173765	bash
261	impact	T1486	Data Encrypted for Impact	2	Encrypt files using 7z (Linux)	53e6735a-4727-44cc-b35b-237682a151ad	bash
262	impact	T1486	Data Encrypted for Impact	3	Encrypt files using ccrypt (Linux)	08cbf59f-85da-4369-a5f4-049cffd7709f	bash
263	impact	T1486	Data Encrypted for Impact	4	Encrypt files using openssl (Linux)	142752dc-ca71-443b-9359-cf6f497315f1	bash
264	impact	T1496	Resource Hijacking	1	macOS/Linux - Simulate CPU Load with Yes	904a5a0e-fb02-490d-9f8d-0e256eb37549	bash
265	impact	T1485	Data Destruction	2	macOS/Linux - Overwrite file with DD	38deee99-fd65-4031-bec8-bfa4f9f26146	bash
266	impact	T1529	System Shutdown/Reboot	3	Restart System via `shutdown` - macOS/Linux	6326dbc4-444b-4c04-88f4-27e94d0327cb	bash
267	impact	T1529	System Shutdown/Reboot	4	Shutdown System via `shutdown` - macOS/Linux	4963a81e-a3ad-4f02-adda-812343b351de	bash
268	impact	T1529	System Shutdown/Reboot	5	Restart System via `reboot` - macOS/Linux	47d0b042-a918-40ab-8cf9-150ffe919027	bash
269	impact	T1529	System Shutdown/Reboot	6	Shutdown System via `halt` - Linux	918f70ab-e1ef-49ff-bc57-b27021df84dd	bash
270	impact	T1529	System Shutdown/Reboot	7	Reboot System via `halt` - Linux	78f92e14-f1e9-4446-b3e9-f1b921f2459e	bash
271	impact	T1529	System Shutdown/Reboot	8	Shutdown System via `poweroff` - Linux	73a90cd2-48a2-4ac5-8594-2af35fa909fa	bash
272	impact	T1529	System Shutdown/Reboot	9	Reboot System via `poweroff` - Linux	61303105-ff60-427b-999e-efb90b314e41	bash
273	execution	T1053.007	Container Orchestration Job	1	ListCronjobs	ddfb0bc1-3c3f-47e9-a298-550ecfefacbd	bash
274	execution	T1053.007	Container Orchestration Job	2	CreateCronjob	f2fa019e-fb2a-4d28-9dc6-fd1a9b7f68c3	bash
275	execution	T1053.003	Cron	1	Cron - Replace crontab with referenced file	435057fb-74b1-410e-9403-d81baf194f75	bash
276	execution	T1053.003	Cron	2	Cron - Add script to all cron subfolders	b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0	bash
277	execution	T1053.003	Cron	3	Cron - Add script to /var/spool/cron/crontabs/ folder	2d943c18-e74a-44bf-936f-25ade6cccab4	bash
278	execution	T1609	Container Administration Command	1	ExecIntoContainer	d03bfcd3-ed87-49c8-8880-44bb772dea4b	bash
279	execution	T1053.006	Systemd Timers	1	Create Systemd Service and Timer	f4983098-bb13-44fb-9b2c-46149961807b	bash
280	execution	T1053.006	Systemd Timers	2	Create a user level transient systemd service and timer	3de33f5b-62e5-4e63-a2a0-6fd8808c80ec	sh
281	execution	T1053.006	Systemd Timers	3	Create a system level transient systemd service and timer	d3eda496-1fc0-49e9-aff5-3bec5da9fa22	sh
282	execution	T1059.004	Unix Shell	1	Create and Execute Bash Shell Script	7e7ac3ed-f795-4fa5-b711-09d6fbe9b873	sh
283	execution	T1059.004	Unix Shell	2	Command-Line Interface	d0c88567-803d-4dca-99b4-7ce65e7b257c	sh
284	execution	T1059.004	Unix Shell	3	Harvest SUID executable files	46274fc6-08a7-4956-861b-24cbbaa0503c	sh
285	execution	T1059.004	Unix Shell	4	LinEnum tool execution	a2b35a63-9df1-4806-9a4d-5fe0500845f2	sh
286	execution	T1059.006	Python	1	Execute shell script via python's command mode arguement	3a95cdb2-c6ea-4761-b24e-02b71889b8bb	sh
287	execution	T1059.006	Python	2	Execute Python via scripts (Linux)	6c4d1dcb-33c7-4c36-a8df-c6cfd0408be8	sh
288	execution	T1059.006	Python	3	Execute Python via Python executables (Linux)	0b44d79b-570a-4b27-a31f-3bf2156e5eaa	sh
289	execution	T1059.006	Python	4	Python pty module and spawn function used to spawn sh or bash	161d694c-b543-4434-85c3-c3a433e33792	bash
290	execution	T1053.002	At	2	At - Schedule a job	7266d898-ac82-4ec0-97c7-436075d0d08e	sh
291	initial-access	T1078.004	Cloud Accounts	1	Creating GCP Service Account and Service Account Key	9fdd83fd-bd53-46e5-a716-9dec89c8ae8e	gcloud
292	exfiltration	T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	2	Exfiltrate data HTTPS using curl linux	4a4f31e2-46ea-4c26-ad89-f09ad1d5fe01	bash
293	exfiltration	T1048	Exfiltration Over Alternative Protocol	1	Exfiltration Over Alternative Protocol - SSH	f6786cc8-beda-4915-a4d6-ac2f193bb988	sh
294	exfiltration	T1048	Exfiltration Over Alternative Protocol	2	Exfiltration Over Alternative Protocol - SSH	7c3cb337-35ae-4d06-bf03-3032ed2ec268	sh
295	exfiltration	T1030	Data Transfer Size Limits	1	Data Transfer Size Limits	ab936c51-10f4-46ce-9144-e02137b2016a	sh
296	exfiltration	T1048.003	Exfiltration Over Unencrypted Non-C2 Protocol	1	Exfiltration Over Alternative Protocol - HTTP	1d1abbd6-a3d3-4b2e-bef5-c59293f46eff	manual
297	exfiltration	T1048.003	Exfiltration Over Unencrypted Non-C2 Protocol	3	Exfiltration Over Alternative Protocol - DNS	c403b5a4-b5fc-49f2-b181-d1c80d27db45	manual